Secure management and regeneration of cryptographic keys within a computing environment using permissioned distributed ledgers

ABSTRACT

The disclosed exemplary embodiments include computer-implemented systems, devices, and processes that securely manage and regenerate cryptographic keys using permissioned distributed ledgers. For example, a device may receive, from a first computing system, data indicative of a recordation of a first public key onto a distributed ledger. Based on an occurrence of a regeneration condition, the device may transmit, to a second computing system, a second public key and a first digital signature, and the second computing system may validate the first digital signature, apply a second digital signature to the second public key, and transmit the second public key and the digital signatures to the first computing system. The device also receives, from the first computing system, additional data indicative of a recordation of the second public key onto the distributed ledger, and based on the additional data, the device may invalidate the first private key.

TECHNICAL FIELD

The disclosed embodiments generally relate to computer-implementedsystems and processes that securely manage and regenerate cryptographickeys within a computing environment using permissioned distributedledgers.

BACKGROUND

Today, many financial institutions, merchants, and other businessesestablish and maintain customer loyalty or rewards programs on behalf ofcertain, and potentially overlapping, groups of customers. By way ofexample, a business may establish a loyalty program that, whenimplemented through a computing system of the business, provides acustomer with a specified number of “points” in response to a qualifyingpurchase of a product or service from that business. In other examples,a financial institution may establish a loyalty program that provides acustomer with an additional number of points in response to aninitiation of a purchase transaction involving a payment instrument orfinancial-services account issued by the financial institution, or inresponse to a referral of a previously unserved customer to that loyaltyprogram. Further, in some examples, the loyalty program may alsoestablish rules that, upon implementation by one or more computingsystems, enable the customer to exchange accrued points for discounts onvarious products or services provided by that business.

SUMMARY

In some examples, a device includes a communications interface, a memorystoring instructions, and at least one processor coupled to thecommunications interface and the memory. The at least one processor isconfigured to execute the instructions to receive, via thecommunications interface, first confirmation data from a first computingsystem. The first confirmation data is indicative of a recordation of afirst public key of an application program executed by the device withina first element of a distributed ledger, and the first public key isassociated with a first private key maintained within a portion of thememory. Based on a determined occurrence of a regeneration conditionassociated with the first public key, the at least one processor isfurther configured to execute the instructions to transmit, via thecommunications interface to a second computing system, a registrationrequest and a first digital signature applied to the registrationrequest. The registration request includes a second public key of theapplication program, and the second computing system is configured tovalidate the first digital signature, apply a second digital signatureto the registration request and the first digital signature, andtransmit the registration request, the first digital signature, and thesecond digital signature to the first computing system. The at least oneprocessor is further configured to execute the instructions to receive,via the communications interface, second confirmation data from thefirst computing system. The second confirmation data is indicative of arecordation, within a second element of the distributed ledger, of thesecond public key and pointer data identifying the first element. Basedon the second confirmation data, the at least one processor is furtherconfigured to execute the instructions to store a second private keyassociated with the second public key within the portion of the memory.The storage of the second private key invalidates the first private key.

In other examples, a computer-implemented method includes receiving,using at least one processor, first confirmation data from a firstcomputing system. The first confirmation data is indicative of arecordation of a first public key of an application program within afirst element of a distributed ledger, the application program isexecuted by the at least one processor, and the first public key isassociated with a first private key maintained within a portion of asecure data repository. Based on a determined occurrence of aregeneration condition associated with the first public key,transmitting, using the at least one processor, a registration requestand a first digital signature applied to the registration request to asecond computing system, the registration request comprising a secondpublic key of the application program, and the second computing systemis configured to validate the first digital signature, apply a seconddigital signature to the registration request and the first digitalsignature, and transmit the registration request, the first digitalsignature, and the second digital signature to the first computingsystem. The computer-implemented method also includes receiving, usingthe at least one processor, second confirmation data from the firstcomputing system. The second confirmation data is indicative of arecordation, within a second element of the distributed ledger, of thesecond public key and pointer data identifying the first element. Basedon the second confirmation data, the computer-implemented method alsoincludes, using the at least one processor, storing a second private keyassociated with the second public key within the portion of the securedata repository. The storage of the second private key invalidates thefirst private key.

Additionally, in some examples, an apparatus includes a communicationsinterface, a memory storing instructions, and at least one processorcoupled to the communications interface and the memory. The at least oneprocessor being configured to execute the instructions to receive, froma device via the communications interface, a registration request and afirst digital signature applied to the registration request. Theregistration request is generated by an application program executed atthe device and in response to a detected occurrence of a regenerationcondition associated with a first public key of the application program,the first public key is recorded within a first element of a distributedledger, and the registration request includes a second public key of theapplication program. Based on a validation of the first digitalsignature, the at least one processor is further configured to executethe instructions to approve the registration request and apply a seconddigital signature to the registration request and the first digitalsignature. The second digital signature is indicative of the approval ofthe registration request by the apparatus. The at least one processor isfurther configured to execute the instructions to transmit, via thecommunications interface, the registration request, the first digitalsignature, and the second digital signature to a computing system. Thecomputing system is configured to validate the first digital signatureand the second digital signature, and based on the validation of thefirst and second digital signature, to perform operations that record,within a second element of the distributed ledger, the second public keyand pointer data identifying the first element.

The details of one or more exemplary embodiments of the subject matterdescribed in this specification are set forth in the accompanyingdrawings and the description below. Other potential features, aspects,and advantages of the subject matter will become apparent from thedescription, the drawings, and the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1, 2A-2C, 3A, and 3B are block diagrams illustrating portions ofan exemplary computing environment, in accordance with some exemplaryembodiments.

FIGS. 4A and 4B are flowcharts of exemplary processes for securelydistributing, and managing the distribution of, cryptographic keyswithin a computing environment using permissioned distributed ledgers,in accordance with some exemplary embodiments.

FIGS. 5A, 5B, 6A, 6B, and 7A-7C are block diagrams illustrating portionsof an exemplary computing environment, in accordance with some exemplaryembodiments.

FIGS. 8A and 8B are flowcharts of exemplary processes for securelyinitiating and managing a distribution of digital assets within acomputing environment using permissioned distributed ledgers, inaccordance with some exemplary embodiments.

FIGS. 9A and 9B are block diagrams illustrating portions of an exemplarycomputing environment, in accordance with some exemplary embodiments.

FIGS. 10A-10C are flowcharts of exemplary processes for securelymanaging and regenerating cryptographic keys within a computingenvironment using permissioned distributed ledgers, in accordance withsome exemplary embodiments.

FIGS. 11A, 11B, and 12A-12C are block diagrams illustrating portions ofan exemplary computing environment, in accordance with some exemplaryembodiments.

FIGS. 13A and 13B are flowcharts of exemplary processes for initiatingand managing transfers of digital assets between computing systems usingpermissioned distributed ledgers, in accordance with some exemplaryembodiments

Like reference numbers and designations in the various drawings indicatelike elements.

DETAILED DESCRIPTION

This specification relates to computer-implemented processes that, amongother things, manage and track an interaction between a customer of aloyalty or rewards program and one or more computing systems associatedwith that loyalty or rewards program using permissioned distributedledgers established and maintained within a program-specific,permissioned distributed-ledger network. By way of example, and asdescribed herein, each customer of the loyalty program may be associatedwith unique cryptographic identifier, such as a public cryptographickey, that uniquely identifies the customer during interaction with theone or more computing systems, and within elements of data, e.g.,interaction-specific, digitally signed data “objects,” recordedimmutably within the elements of the distributed ledger. For instance, aparticular interaction between a customer and the loyalty program mayinvolve data exchanged between multiple computing systems and deviceswithin a distributed environment, and a digital signature applied to aninteraction-specific data object by each of these multiple computingsystems and devices may indicate an approval or, or a consent to, theparticular interaction by the subset of these computing systems anddevices associated with a particular one of the loyalty programs andfurther by computing systems and devices associated with multiple,cooperating loyalty or rewards programs.

In some instances, the loyalty program may be established and maintainedby a financial institution or business on behalf of certain customers.By way of example, a business may establish a loyalty program thatprovides a customer with a specified number of “points” in response to aqualifying purchase of a product or service from that business. In otherexamples, a financial institution may establish a loyalty program thatprovides a customer with a specified number of points in response to aninitiation of a purchase transaction involving a payment instrument orfinancial-services account issued by the financial institution. Each ofthe loyalty or rewards programs may also reward the customer with anadditional, or alternate, numbers of points based on a referral of apreviously unserved customer to that loyalty program, and may in someinstances, may establish and enforce rules that enable the customer toexchange accrued points for discounts on various products or services.

Further, a computing system operated by each the financial institutionsor businesses may perform operations that implement corresponding onesof the loyalty programs, e.g., based on program-specific customeridentifiers, transactional data, and campaign data maintained withinportions of locally or remotely accessible databases or datarepositories. These computing systems may also perform operations thatprovision an executable application, such as a wallet application, to acomputing device of each customer (e.g., a smart phone, etc.). Whenexecuted by each of the computing devices, the wallet application mayenable each customer to interact with the computing systems and accrueor exchange points within a corresponding one of the loyalty programsand in accordance with portions of the campaign data.

While the operations implemented collectively by the executed walletapplications and computing systems may enable a particular customer toaccrue loyalty points at a corresponding financial institution orbusiness, and to exchange these accrued loyalty points for products orservices offered for sale at one or more merchants having a relationshipwith the corresponding financial institution or business, theseoperations are often incapable of allowing a single customer to exchangepoints from a first loyalty program for corresponding points from asecond loyalty program, or of facilitating a peer-to-peer transactionbetween members of multiple loyalty programs. Indeed, the customeridentifiers and corresponding points are specific to each of the loyaltyprograms and to the corresponding computing systems, and theseconventional processes facilitate minimal or no interoperability betweenthe corresponding ones of the loyalty programs, much less between theloyalty programs and unrelated merchants or third parties (e.g., eachloyalty program is implemented on a “closed” platform).

Certain of the exemplary processes described herein may establish aloyalty and rewards ecosystem based not on a program-specific pointstructure, but instead based on digital assets allocated and managedprogrammatically based on discrete elements of interaction data, e.g.,data objects, recorded within elements of a cryptographically secure andpermissioned distributed ledger. In some instances, the generation andrecordation of these interaction-specific data objects onto the elementsof the permissioned distributed ledger in conjunction with uniquecryptographic customer identifiers may couple a customer identity to thecryptographic structure of the distributed ledger, which furtherprovides a cryptographic proof of an authenticity of each exchange ortransaction and an immutable record that establishes a tamper-evidenthistory of the exchanges or transactions involving digital assetsallocated to each of the customers. Further, the immutability andcryptographically secure properties of the permissioned distributedledger may facilitate interoperability between loyalty programs andestablished and maintained by unrelated financial institutions andbusinesses, many of which are characterized by overlapping members.

A. Exemplary Computing Environments

FIG. 1 is a diagram of an exemplary computing environment 100,consistent with certain disclosed embodiments. For example, asillustrated in FIG. 1, environment 100 may include one or more computingdevices, such as client device 102 operated by user 101, and clientdevice 102 operated by user 121. Environment 100 may also include one ormore computing systems associated application programs executed atclient devices 102 and 122, such as wallet system 130, and one or morecomputing systems associated with a loyalty or rewards program, such asprogram system 140. Further, and as illustrated in FIG. 1, environment100 may also include a gateway system 160 and one or more node systems180, including node system 182, that perform any of the exemplaryprocesses described herein to establish, manage, and update acryptographically secure, permissioned distributed ledger, e.g.,permissioned distributed ledger 190.

In some instances, each of client devices 102 and 122, wallet system130, program system 140, gateway system 160, and node systems 180,including node system 182, may be interconnected through one or morecommunications networks, such as communications network 120. Examples ofnetwork 120 include, but are not limited to, a wireless local areanetwork (LAN), e.g., a “Wi-Fi” network, a network utilizingradio-frequency (RF) communication protocols, a Near Field Communication(NFC) network, a wireless Metropolitan Area Network (MAN) connectingmultiple wireless LANs, and a wide area network (WAN), e.g., theInternet. In some instances, the devices and systems operating withinenvironment 100 may perform operations that establish and maintain oneor more secure channels of communication across network 120, such as,but not limited to, a transport layer security (TSL) channel, a securesocket layer (SSL) channel, or any other suitable secure communicationchannel.

Each of client devices 102 and 122 may include one or more tangible,non-transitory memories that store data and/or software instructions andone or more processors configured to execute the software instructions.The stored software instructions may, for example, include one or moreapplication programs, one or more application modules, or other elementsof code executable by the one or more processors. For example, asillustrated in FIG. 1, client device 102 may store, within the one ormore tangible, non-transitory memories, an executable wallet application104, which may be provisioned to client device 102 and supported bywallet system 130. In some instances, and upon execution by the one ormore processes of client device 102, wallet application 104 mayestablish communications with one or more of the computing systemswithin environment 100, and may perform any of the exemplary processesdescribed herein to, among other things, request a registration as amember of loyalty program (e.g., based on a recordation of a publiccryptographic key and corresponding registration data within theelements of the distributed ledger), or request a recordation of aregenerated public cryptographic key within the permissioned distributedledger (e.g., in response to a detected occurrence of a regenerationevent).

Further, and based on data exchanged with one or more of the computingsystems of environment 100, executed wallet application 104 may alsoperform operations that, among other things, request an allocation of adigital asset in response to a completed and successful referral of anadditional, unserved customer to the loyalty program, request aredemption of an allocated digital asset for physical or virtualproducts offered by the financial institution or business associatedwith the loyalty program, or transfer an allocated digital asset to anadditional member of the loyalty program or to a member of another,unrelated loyalty program. In some examples, executed wallet application104 may perform operations that apply a digital signature to datacharacterizing each of these requests, which, as described herein, maybe indicative of an approval of, and a consent to, the requestedregistration, recordation, allocation, redemption, or transfer by user101.

Client device 102 may also include a display unit coupled to the one ormore processors and configured to present interface elements to user 101and an input unit coupled to the one or more processors and configuredto receive input from user 101. By way of example, the display unit mayinclude, but is not limited to, an LCD display, a TFT display, and OLEDdisplay, or other appropriate type of display unit, and the input unitmay include, but are not limited to, a keypad, keyboard, touchscreen,fingerprint scanner, stylus, or any other appropriate type of inputunit. In some instances, the functionalities of the display and inputunits may be combined into a single device, such as a pressure-sensitivetouchscreen display unit that can present interface elements and candetect an input from user 101 via a physical touch. Further, clientdevice 102 may also include a communications unit or interface, such asone or more wireless transceivers, coupled to the one or more processorsfor accommodating wired or wireless internet communication with the oneor more computing devices and systems operating within environment 100.

Further, although not illustrated in FIG. 1, client device 122 may alsomaintain, within the one or more tangible, non-transitory memories, anexecutable wallet application 124 provisioned to client device 122 andsupported by wallet system 130. In some instances, and upon execution bythe one or more processors of client device 122, executed walletapplication 124 may cause client device 122 to initiate, andparticipate, any of the exemplary registration, recordation, allocation,redemption, or transfer processes described herein, e.g., based oninteraction with one or more of the computing systems operating withinenvironment 100, such as wallet system 130 or program system 140.Additionally, and as described herein, client device 122 may alsoinclude a display unit coupled to the one or more processors andconfigured to present interface elements to user 121, an input unitcoupled to the one or more processors and configured to receive inputfrom user 121, and a communications unit or interface coupled to the oneor more processors for accommodating wired or wireless internetcommunication with the one or more computing devices and systemsoperating within environment 100.

In some instances, client device 102 may be associated with or operableby user 101, and client device 122 may be associated with or operable byuser 101. Examples of client devices 102 and 122 may include, but arenot limited to, a personal computer, a laptop computer, a tabletcomputer, a notebook computer, a hand-held computer, a personal digitalassistant, a portable navigation device, a mobile phone, a smart phone,a wearable computing device (e.g., a smart watch, a wearable activitymonitor, wearable smart jewelry, and glasses and other optical devicesthat include optical head-mounted displays (OHMDs), an embeddedcomputing device (e.g., in communication with a smart textile orelectronic fabric), and any other type of computing device that may beconfigured to store data and software instructions, execute softwareinstructions to perform one or more of the exemplary processes describedherein.

Referring back to FIG. 1, each of wallet system 130, program system 140,gateway system 160, and node systems 180 (including node system 182) mayrepresent a computing system that includes one or more servers andtangible, non-transitory memory devices storing executable code andapplication modules. The one or more servers may each include one ormore processors or processor-based computing devices, which may beconfigured to execute portions of the stored code or application modulesto perform operations consistent with the disclosed embodiments.Further, in some examples, each of wallet system 130, program system140, gateway system 160, and node systems 180 (including node system182) may include a communications unit or interface coupled to the oneor more processors for accommodating wired or wireless communicationacross network 120 with any of the additional network-connected systemsor devices described herein, e.g., a transceiver device.

For example, one or more of wallet system 130, program system 140,gateway system 160, and node systems 180 (including node system 182) maycorrespond to a discrete computing system, as described herein. In otherinstances, the functionalities of wallet system 130, program system 140,gateway system 160, and node systems 180 (including node system 182) maybe performed by a single, discrete computing system operating withinenvironment 100, or by a combination of discrete computing systemsoperating within environment 100. Further, in some instances, one ormore of wallet system 130, program system 140, gateway system 160, andnode systems 180 (including node system 182) may correspond to adistributed system that includes computing components distributed acrossone or more networks, such as network 120, or other networks, such asthose provided or maintained by cloud-service providers (e.g., GoogleCloud™, Microsoft Azure™, etc.).

To perform any of the exemplary processes described herein, walletsystem 130 may maintain, within the one or more tangible, non-transitorymemories, a data repository 131 that includes a credential data store132 and a cryptographic data store 134. In some instances, credentialdata store 132 may maintain elements of structured or unstructured datathat identify and characterize each executable wallet applicationprovisioned to a corresponding device operating within environment 100(e.g., executable wallet application 104 provisioned to client device102), a customer associated with each of the provisioned executablewallet applications (e.g., user 101), and each of the correspondingdevices (e.g., client device 102). For example, and for executablewallet application 104 provisioned to client device 102, the elements ofcredential data store 132 may include, but are not limited to, a uniqueapplication identifier of executable wallet application 104 (e.g., anapplication cryptogram, an alphanumeric identifier, etc.),authentication credentials associated with user 101 (e.g., analphanumeric login credential, an alphanumeric password, or a biometriccredential, such as a facial image or a thumbprint image, etc.), and adevice identifier of client device 102 (e.g., an Internet Protocol (IP)address, a Media Access Control (MAC) address, etc.).

Further, credential data store 132 may also associate each of theapplication identifiers (e.g., the application cryptograms) with acorresponding public cryptographic key, which may serve as an identifierof each of the executable wallet applications. By way of example,credential data store 132 may include data elements that associate theapplication cryptogram (or other identifier) of executable walletapplication 104, the authentication credentials of user 101, and thedevice identifier of client device 102 with a public cryptographic keyof executable wallet application 104, which may be generated, orselectively re-generated by executable wallet application 104 using anyof the exemplary processes described herein. In some instances,credential data store 132 may further associate the applicationidentifiers of each of the provisioned executable wallet applications(e.g., the application cryptogram or other identifier or executablewallet application 104) with one or more digital tokens, such as, butnot limited to, application-specific, one-time-use (OTU) tokensgenerated and provisioned to corresponding devices (e.g., client device102) during any of the exemplary processes described herein.

In some examples, cryptographic data store 134 may include a publiccryptographic key of wallet system 130, along with a correspondingprivate cryptographic key. Wallet system 130 may, for instance, performoperations that generate the public and private cryptographic keys usinga Diffie-Hellman key exchange protocol, a Digital Signature Standard(DSS) key generation algorithm, an elliptic-curve key generationalgorithm (e.g., an ECDPSA P-256 algorithm based on a random seed), anRSA encryption algorithm, a homomorphic key generation algorithm (e.g.,a FTFHE scheme, a SEAL encryption scheme, or a PALISADE encryptionscheme, etc.), or any other appropriate key generation algorithm.Cryptographic data store 134 may also maintain a public cryptographickey or a symmetric cryptographic key associated with one of thecomputing systems that operate within environment 100, such as programsystem 140 and gateway system 160.

Program system 140 may be associated with, and operated by, financialinstitution, merchant, or other business entity that establishes,maintains, and supports a corresponding loyalty or rewards program. Byway of example, a financial institution may establish a loyalty programthat allocates one or more redeemable and transferrable digital assetsin response to an initiation of a purchase transaction involving apayment instrument or financial-services account issued by the financialinstitution (e.g., a “qualifying” transaction), or in response to areferral of a previously unserved customer to that loyalty program. Asdescribed herein, the allocated digital asset may correspond to adigital “coin” or other electronic asset, which a member of the loyaltyprogram, such as user 101, may redeem for one or more predeterminedphysical or digital assets provisioned by the financial institution or abusiness entity associated with that financial institution (e.g., astored-value card denominated in a fiat currency, etc.), may transfer toanother member of the loyalty program (e.g., via a peer-to-peertransaction involving other physical or digital assets), or may transferto a member of an additional, unrelated loyalty program (e.g., via apeer-to-peer transaction based on an exchange rate established by mutualagreement).

To perform any of the exemplary processes described herein, programsystem 140 may maintain, within the one or more tangible, non-transitorymemories, a data repository 141 that includes a member database 142, acampaign data store 144, a redemption data store 146, and rules database148. In some examples, member database 142 may include structured orunstructured data records that identify and characterize each of themembers of the corresponding loyalty program, e.g., user of clientdevices executing corresponding wallet applications that perform any ofthe exemplary registration processes described herein. By way ofexample, and for a particular member of the loyalty program, such asuser 101, the structured or unstructured records of member database 142may include, but are not limited to, a unique identifier of user 101(e.g., a name, a login credential, etc.), an identifier of a deviceoperable by user 101 (e.g., the IP or MAC address of client device 102),contact information associated with user 101 (e.g., an email address ofuser 101, a telephone number assigned to client device 102, asocial-media handle, etc.), and profile data associated with user 101(e.g., a full name, address, transaction preferences, values ofdemographic parameters, etc.). In some instances, all or a selectedportion of the structured or unstructured data records maintained withinmember database 142 on behalf of user 101, or on behalf of other membersof the loyalty program, may be immutably recorded within the elements ofdistributed ledger 190, e.g., as registration objects generated throughany of the exemplary processes described herein.

Campaign data store 144 may include elements of campaign dataidentifying one or more prior, pending, or future campaigns associatedwith the loyalty program operated by the financial institution. By wayof example, campaign data store 166 may include elements of campaigndata that specify a redeemable and transferrable digital asset (e.g., adigital coin, etc.), or a number of units of that digital asset, forallocation to a member of the loyalty program upon initiation andsuccessful execution of a transaction involving a qualifying product orservice, or involving a qualifying payment instrument or financialservices account issued by the financial institution (e.g., a“qualifying” transaction).

In other examples, campaign data store 144 may include elements ofcampaign data that identify and characterize a referral campaign, whichenables a member of the loyalty program (e.g., user 101 associated withclient device 102) to refer an additional customer of the financialinstitution for membership in the loyalty program (e.g., user 121associated with client device 122). Further, and responsive to aregistration of the additional customer within the loyalty program usingany of the exemplary processes described herein (e.g., a “successful”referral), the referral campaign may allocate a redeemable andtransferrable digital asset (e.g., a digital coin, etc.), or a number ofunits of that digital asset, to the current member as a reward for thenow-successful referral and to the additional customer as an incentivefor registering for membership in the loyalty program. For instance, theelements of campaign data that characterize the referral campaign mayinclude temporal data that specifies a duration of the campaign,eligibility data that identifies on-boarding and eligibility criteriaapplicable to the additional customer, and allocation data specifyingone or more allocation rules that, when satisfied, trigger an allocationof the redeemable and transferrable digital asset, or the numbers ofunits of that digital asset, to each of the existing and additionalcustomers in response to the successful referral.

Redemption data store 146 may include elements of redemption data thatidentify one or more physical or digital products (e.g., a stored-valueor “gift” card denominated in a fiat currency, etc.) redeemable bymembers of the loyalty program in exchange for the digital assets (e.g.,the units of the digital coins) allocated through participation in theexemplary qualifying transactions or the referral campaigns describedherein, or received through the exemplary peer-to-peer (P2P) transfersdescribed herein. For example, the elements of redemption data mayspecify each of the physical or digital products, and further identifyeach of the digital assets, of quantities of the digital assets,redeemable for corresponding ones of these redeemable assets,

Further, rules database 148 may include elements of data that facilitatepeer-to-peer transactions involving members of differing loyalty orrewards programs and digital assets allocated within the differingloyalty or rewards programs. For example, rules database 148 may includeexchange data that specifies a mutually agreeable rate of exchangebetween a unit of the digital asset allocated by the loyalty program ofthe financial institution and corresponding units of additional digitalassets allocated to members of other loyalty or rewards programs, e.g.,as established by other financial institutions, merchants, orbusinesses. Further, in some instances, the elements of rules database148 may also identify and specify one or more transaction rulesapplicable to the peer-to-peer (P2P) transactions involving the membersof differing loyalty or rewards programs. By way of example, thetransaction rules may establish minimum or maximum values for each ofthe peer-to-peer transactions (e.g., lower or upper bounds), mayestablish a maximum transaction velocity for the counterparties involvedin the peer-to-peer transactions (e.g., an upper bound on a number ofexecuted peer-to-peer transactions during a predetermined time period),or may establish a minimum balance of digital assets to a current memberof the loyalty program involved in the peer-to-peer transaction (e.g.,the balance of digital assets available for transfer exceeds a quantityof digital assets involved in a peer-to-per transaction by apredetermined amount). The elements of rules database 148 may alsoidentify and characterize one or more fraud detection and mitigationprocesses application to the exemplary asset-redemption transactions andP2P transaction described herein.

In some instances, not illustrated in FIG. 1, program system 140 maytransmit all, or a selected portion of the elements of campaign datamaintained within campaign data store 144, the elements of redemptiondata maintained within redemption data store 146, and additionally, oralternatively, the data maintained within rules database 148, acrossnetwork 120 to gateway system 160, e.g., via a secure, programmaticcommunications channel. Additionally, or alternatively, program system140 may also transmit all, or a selected portion, of the elements of thecampaign data maintained within campaign data store 144 (e.g., thetemporal data, the eligibility data, and/or the allocation data) andrules database 148 (e.g., the exchange data and the transaction rules),to one or more of node systems 180, which may perform any of theexemplary processes described herein to record the transmitted elementsof campaign data within one or more elements of distributed ledger 190,which may be accessible to gateway system 160.

Referring back to FIG. 1, gateway system 160 may perform operations thatvalidate one or more of the exemplary requests for registration,key-regeneration, allocation, redemption, or transfer processesdescribed herein, which may be generated by a wallet applicationexecuted at a corresponding one of the devices operating withinenvironment 100 (e.g., by wallet application 104 executed at clientdevice 102), and which may be processed and approved by wallet system130. By way of example, a corresponding one of the exemplary requestsmay include at least at first digital signature applied by the executedwallet application (e.g., that indicates and approval of and consent tothe corresponding request by a user associated with the executed walletapplication), and a second digital signature applied by wallet system130 (e.g., that indicates the approval or and consent to thecorresponding request by wallet system 130), and gateway system 160 mayperform any of the exemplary processes described herein to validate thecorresponding request based on, among other things, a verification ofthe first and second digital signatures and a determination that thecorresponding requests is consistent with one or more fraud detectionand mitigation processes, or one or more transaction rules, associatedwith the corresponding request. Based on the determined validity of thecorresponding request, gateway system 160 may perform additionalprocesses that broadcast elements of request- and customer-specificdata, e.g., data “objects,” to one or more of node systems 180 forrecordation one or more elements of distributed ledger 190.

To perform any of the exemplary processes described herein, gatewaysystem 160 may maintain, within the one or more tangible, non-transitorymemories, a data repository 161 that includes a credential data store162, cryptographic data store 164, a campaign data store 166, and arules database 168. In some instances, credential data store 162 maymaintain elements of structured or unstructured data that identify andcharacterize one or more executable wallet application provisioned tocorresponding devices operating within environment 100 (e.g., executablewallet application 104 provisioned to client device 102), and each ofthe corresponding devices (e.g., client device 102). For example, andfor executable wallet application 104 provisioned to client device 102,the elements of credential data store 162 may include, but are notlimited to, a unique application identifier of executable walletapplication 104 (e.g., an application cryptogram, an alphanumericidentifier, etc.), a device identifier of client device 102 (e.g., anInternet Protocol (IP) address, a Media Access Control (MAC) address,etc.), and challenge data that includes an application-specific codechallenge having a predetermined format or composition (e.g., a hashvalue of a plaintext cipher maintained at gateway system 160).

In some examples, cryptographic data store 164 may include a publiccryptographic key of gateway system 160, along with a correspondingprivate cryptographic key. Gateway system 160 may, for instance, performoperations that generate the public and private cryptographic keys usinga Diffie-Hellman key exchange protocol, a Digital Signature Standard(DSS) key generation algorithm, an elliptic-curve key generationalgorithm (e.g., an ECDPSA P-256 algorithm based on a random seed), anRSA encryption algorithm, a homomorphic key generation algorithm (e.g.,a FTFHE scheme, a SEAL encryption scheme, or a PALISADE encryptionscheme, etc.), or any other appropriate key generation algorithm.Cryptographic data store 164 may also maintain a public cryptographickey or a symmetric cryptographic key associated with one of thecomputing systems that operate within environment 100, such as walletsystem 130, program system 140, and node system 180 (including nodesystem 182).

Campaign data store 166 may include any of the exemplary elements ofcampaign data described herein (e.g., in reference to campaign datastore 144 of program system 140), and rules database 168 may include anyof the exemplary elements of transaction-specific rules and frauddetection and mitigation processes described herein (e.g., in referenceto rules database 148 of program system 140). Gateway system 160 mayalso maintain, within data repository 161, a local version ofdistributed ledger 190. In some instances, and as described herein,distributed ledger 190 may include elements that maintain acryptographically secure and immutable record of each of customerregistered within the loyalty program established and maintained by thefinancial institution, and further, a time evolving record of the publiccryptographic keys that identify each of the registered customers, e.g.,a customer-specific certificate chain. The elements of distributedledger 190 may also establish and maintain a cryptographically secure,immutable, and time-evolving record of not only the digital assetsallocated to and redeemed by each of the members of the loyalty program,but also of the digital assets transferred to, and received from,counterparties through peer-to-peer transactions.

In some examples, as the members of the loyalty program are identifiedwithin the elements of distributed ledger 190 by corresponding publiccryptographic keys, the elements of permissioned distributed ledger 190(and each additional or alternate one of the exemplary permissioneddistributed ledger described herein) may be queried, e.g., via adistributed smart contract, to identify a current balance of digitalassets available for redemption or transfer. For instance, asillustrated in FIG. 1, permissioned distributed ledger 190 may includeone or more elements, such as smart contract elements 192, that recordcode or software instructions that, when executed by one or more of nodesystems 180 (including node system 182), query additional elements ofpermissioned distributed ledger 190 to compute a balance of digitalassets associated with a particular public cryptographic key (e.g., thatidentifies executed wallet application 104 of client device 102) andavailable for redemption or transfer. In other examples, not illustratedin FIG. 1, all or a selected portion of campaign data store 166 andrules database 168 may be recorded within the elements of distributedledger 190.

In some examples, gateway system 160 and each of node systems 180,including node system 182, may collectively form a portion of apermissioned, distributed-ledger network, and each of gateway system 160and node systems 180, including node system 182, may maintain a localversion of permissioned distributed ledger 190 within a correspondingtangible, non-transitory memory (e.g., within data repository 161 ofgateway system 160, and within data repository 183 of node system 182).As described herein, one or more of node systems 180, including nodesystem 182, may establish, maintain, or update permissioned distributedledger 190 using, among other things, one or more consensus-basedprocesses, and may broadcast updated versions of distributed ledger 190across network 120 to the other components of the permissioned,distributed-ledger network. In other instances, a selected one of nodesystems 180, such as node system 182, may perform operations thatestablish, maintain, or update distributed ledger 190 directly andwithout consensus-based processing, and may broadcast the updatedversion of distributed ledger 190 across network 120 to other ones ofnode systems 180 and to gateway system 160.

B. Secure Generation and Distribution of Cryptographic Keys within aComputing Environment using Permissioned Distributed Ledgers

In some examples, and as described herein, program system 140 mayperform operations that generate one or more elements of campaign data(e.g., as maintained within campaign data store 144) that identify,specify, and characterize a referral campaign operative within a loyaltyprogram established and maintained by the financial institution. Forinstance, the referral campaign may enable a current member of theloyalty program, e.g., user 101, to refer an additional customer of thefinancial institution for membership in the loyalty program, andresponsive to a successful registration of the additional customer as amember of the loyalty program, the referral campaign may designate aredeemable or transferrable digital asset (e.g., a digital “coin”), orunits of that digital asset, for allocation to the current member as areward for the now-successful referral and to the additional customer asan incentive to register for membership in the loyalty program.

Referring to FIG. 2A, a campaign engine 202 executed by the one or moreprocessors of program system 140 may access member database 142, and mayfurther access one or more structured or unstructured data records 204,which identify and characterize a current member of the loyalty program,such as user 101. As described herein, data records 204 may includeinformation that identifies user 101, the device associated with user101 (e.g., the IP or MAC address of client device 102), along withadditional elements of contact information and profile data thatidentify and characterize user 101. In some instances, executed campaignengine 202 may extract, from data records 204, a user identifier 206 ofuser 101 (e.g., the name of user 101, such as “John Stone”) and a deviceidentifier 208 of client device 102 (e.g., the IP address).

Further, executed campaign engine 202 may also perform operations thataccess campaign data store 144, and obtain one or more elements 210 ofthe campaign data that identify and characterize the referral campaign.For example, and as described herein, campaign data elements 210 mayinclude temporal data that specifies a duration of the referralcampaign, eligibility data that identifies on-boarding and eligibilitycriteria applicable to the additional customer, and allocation dataspecifying one or more allocation rules that, when satisfied, trigger anallocation of the redeemable and transferrable digital asset, or thenumbers of units of that digital asset, to the current member of theloyalty program in response to a successful referral. Executed campaignengine 202 may package user identifier 206 and all, or a selectedportion, of campaign data elements 210, into corresponding portions ofnotification data 212, which program system 140 may transmit acrossnetwork 120 to client device 102, e.g., using the IP address specifiedwithin device identifier 208.

A programmatic interface associated with wallet application 104, such asapplication programming interface (API) 214, may receive notificationdata 212 from program system 140. In some instances, API 214 may performoperations that trigger an execution of wallet application 104 by theone or more processors of client device 102, and may providenotification data 212 as an input to executed wallet application 104.Executed wallet application 104 may receive notification data 212, andmay process notification data 212 and generate interface elements 216that, when rendered for presentation by display unit 218, collectivelyestablish one or more display screens of a referral interface 220.

For example, as illustrated in FIG. 2A, referral interface 220 mayinclude interface elements 216A, which request that user 101 provideadditional input referring a customer of the financial institution tothe loyalty program in exchange for one or more redeemable andtransferrable digital assets (e.g., “Refer a customer to your bank'sloyalty program and receive ten redeemable coins!,” etc.). Referralinterface 220 may also include an interactive interface element, e.g.,fillable text box 216B, which receives and displays input from user 101identifying the referred customer, and a selectable interface element,e.g., “SUBMIT” icon 216C, which upon selection by user 101, causesclient device 102 generate and transmit a response to notification data212 that includes referral information identifying the referred customerto program system 140.

For example, and upon viewing referral interface 220, user 101 may electto refer an additional customer of the financial institution to theloyalty program and obtain the specified units of the digital asset(e.g., the ten units of the digital coin) in exchange for the referral.To refer the additional customer, user 101 may provide, via an inputunit 222 of client device 102, input 224 that specifies a mobiletelephone number of a device operated by the additional customer (e.g.,“555-123-4567”) within fillable text box 216B, and that selects “SUBMIT”icon 216C. In other instances, user 101 may provide additional oralternate input to fillable text box 216B, such as, but not limited to,an email address of the additional customer, an identifier of theadditional customer within one or more social-media networks, a fullname of the additional customer, or any additional or alternateinformation that facilitates an identification of the additionalcustomer or the mobile device associated with the customer by programsystem 140.

Referring back to FIG. 2A, input unit 222 may receive input 224 (e.g.,that specifies the mobile phone number “555-123-4567” within fillabletext box 216B and selects “SUBMIT” icon 216C) and may route input data226 representative of the received input to executed wallet application104. In some instances, executed wallet application 104 may parse inputdata 226 and extract referral information 228 that identifies theadditional customer referred to the loyalty program by user 101, e.g.,the mobile telephone number “555-123-4567” of the mobile deviceassociated with the additional customer. Further, executed walletapplication 104 may perform operations that package referral information228 into a corresponding portion of a response to notification data 212(e.g., within response data 230), along with one or more identifiers 232of user 101 (e.g., a login credential of user 101 for executed walletapplication 104, etc.), client device 102 (e.g., the IP address, etc.),or executed wallet application 104 (e.g., an application cryptogram,etc.). Executed wallet application 104 may perform further operationsthat cause client device 102 to transmit response data 230 acrossnetwork 120 to program system 140.

A programmatic interface associated with executed campaign engine 202,such as application programming interface (API) 234, may receive androute response data 230 to executed campaign engine 202, which may parseresponse data 230 to extract referral information 228 and the one ormore of identifiers 232. In some instances, and based on the one or moreidentifiers 232 (e.g., that identify user 101, client device 102, orwallet application 104) and on accessed data record 204 of membershipdatabase 142 (which, among other things, identifies user 101 as acurrent member of the loyalty program and associates client device 102with user 101), executed campaign engine 202 may confirm that responsedata 230 represents a valid response to notification data 212 generatedby a device associated with the current member of the loyalty program.Further, and based on referral information 228 (e.g., the mobiletelephone number “555-123-4567”), executed campaign engine 202 mayperform operations that parse member database 142 to determine whetherany data records include, or reference, any portion of referralinformation 228 and as such, to confirm whether the additional customerassociated with referral information 228 does not represent a currentmember of the loyalty program.

For example, if executed campaign engine 202 were to determine thatresponse data 230 does not represent a valid response generated by thecurrent member, or if executed campaign engine 202 were to identify oneor more of the data records of member database 142 that include orreference referral information 228 (e.g., that the additional customerrepresents a current member of the loyalty program), executed campaignengine 202 may discard response data 230 and generate and transmit anerror message indicative of a failed referral across network 120 toclient device 102, e.g., for presentation within a display screen ofreferral interface 220 (not illustrated in FIG. 2A).

In other examples, if executed campaign engine 202 were to determinethat response data 230 represent a valid response, and that theadditional customer does not represent a current member of the loyaltyprogram (e.g., that the data records of member database 142 neitherinclude nor reference referral information 228), executed campaignengine 202 may establish that the additional customer represents a validreferral to the loyalty program. Based on the determination that theadditional customer represents the valid referral, executed campaignengine 202 may perform operations that generate invitation data 236 thatinvites the additional customer to register for membership in theloyalty program in exchange for a redeemable and transferrable digitalasset, or a predetermined number of units of that digital asset.

For example, executed campaign engine 202 may perform any of theexemplary processes described herein to access campaign data elements210 within campaign data store 144, which identify and characterize thereferral campaign. As described herein, campaign data elements 210 mayinclude temporal data that specifies a duration of the referralcampaign, eligibility data that identifies on-boarding and eligibilitycriteria applicable to the additional customer, and allocation dataspecifying one or more allocation rules that, when satisfied, trigger anallocation of the redeemable and transferrable digital asset, or thenumbers of units of that digital asset, to the current member of theloyalty program in response to a successful referral. Executed campaignengine 202 may package all, or a selected portion, of campaign dataelements 210 into corresponding portions of invitation data 236.

Additionally, in some instances, executed campaign engine 202 may alsopackage, into a portion of invitation data 236, information thatidentifies the current member that referred the additional customer tothe loyalty program, such as user identifier 206 that identifies user101. Executed campaign engine 202 may also perform operations thatidentify a mode of communication associated with, and consistent with,referral information 228, and that cause program system 140 to establisha channel of communications with the device operated by the additionalcustomer in accordance with the identified communications module andwith referral information 228, e.g., directly or through one or moreintermediate systems (not illustrated in FIG. 2A).

By way of example, the additional customer referred by user 101 maycorrespond to user 121, and the mobile phone number specified byreferral information 228 (e.g., “555-123-4567”) may be associated withclient device 122. In some instances, executed campaign engine 202 mayperform operations that cause program system 140 to transmit invitationdata 236 across network 120 to the mobile phone number of client device122, e.g., as a message using multimedia messaging service (MMS)protocols, using short message service (SMS) protocols, or usingadditional or alternate messaging protocols that facilitate atransmission of invitation data 236 to the mobile phone number of clientdevice 122. The disclosed embodiments are, however, not limited toprocesses that transmit invitation data 236 to the device of theadditional customer through MMS or SMS messaging, and in other examples,referral information 228 may identify data indicative of one or moreadditional, or alternate, modes of communications for transmittinginvitation data 236 to client device 102.

For instance, referral information 228 may specify an email addressassociated with user 121 (e.g., the additional customer), and executedcampaign engine 202 may perform operations that cause program system 140to transmit invitation data 236 as an attachment to, or an integratedportion of, an email message forwarded to the specified email address ofuser 121. In other instances, referral information 228 may specify ahandle or identifier of user 121 within a social-media network, orwithin one or more messaging applications, and executed campaign engine202 may perform operations that cause program system 140 to transmitinvitation data 236 as an attachment to, or an integrated portion of, amessage directed to the social-media handle or the messaging handle ofuser 101. Further, in other instances, referral information 228 mayinclude an identifier of user 121 or client device 122 within anyadditional or alternate messaging or communications platform availableto program system 140 and to campaign engine 202.

In some examples, client device 122 may receive invitation data 236 as amessage associated with a corresponding messaging or communicationsplatform (e.g., as a portion of an MMS text message, a SMS text message,and email message, etc.), and the one or more processors of clientdevice 122 may execute a messaging application associated with themessaging or communications platform (e.g., a text-messagingapplication, and email client, etc.), which may present the receivedmessage within a corresponding messaging interface (not illustrated inFIG. 2A). For example, the presented message may include a deep link toone or more additional application programs executed by client device122, and based on input provided to the input unit of client device 102that selects the deep link, the executed messaging application mayperform operations that programmatically trigger an execution of walletapplication 124, and that provide invitation data 236 as an input toexecuted wallet application 124 through a corresponding programmaticinterface (neither of which are illustrated in FIG. 2A). In someexamples, and as described herein, executed wallet application 124 maypresent all or a selected portion of invitation data 236 within acorresponding digital interface, and based on additional input receivedvia the corresponding input unit, perform additional operations thatinitiate a cryptographically secure process that facilitates aregistration of user 121 into the loyalty program and a recordation of acryptographically secure registration object that uniquely identifiesand characterizes user 121, and interaction between user 121 and theloyalty program, within an element of a distributed ledger, e.g.,permissioned distributed ledger 190 of FIG. 1.

Referring to FIG. 2B, executed wallet application 124 may receiveinvitation data 236 via the secure, programmatic interface describedherein, e.g., via an application programming interface (API) 238. Insome examples, executed wallet application 124 may process invitationdata 236 and generate interface elements 239 that, when rendered forpresentation by the corresponding display unit (e.g., display unit 240),collectively establish one or more display screens of an invitationinterface 242. For example, as illustrated in FIG. 2B, a display screen243 of invitation interface 242 may include interface elements 243A,which request that user 101 provide additional input that accepts aninvitation to register as a member of the loyalty program within aspecified temporal period in exchange for one or more redeemable andtransferrable digital assets (e.g., “Congratulations! Register for yourbank's loyalty program by December 31^(st) and receive ten digitalcoins!”). Referral interface 220 may also include a first selectableinterface element, e.g., “ACCEPT” icon 243B, which upon selection byuser 121, causes executed wallet application 124 to perform operationsthat, in conjunction with wallet system 130 and gateway system 160,initiate and implement one or more of the exemplary,distributed-ledger-based registration processes described herein.Further, referral interface 220 may include a second selectableinterface element, e.g., “DECLINE” icon 243C, which upon selection byuser 121, indicates an intention by user 121 to decline the invitationfor membership in the loyalty program and the proffered digital assets.

For example, user 121 may elect to accept the invitation from programsystem 140 and to register as a member of the loyalty program exchangefor the proffered units of the redeemable and transferrable digitalassets. To accept the invitation and initiate a performance of theexemplary, distributed-ledger-based registration processes describedherein, user 121 may provide, via an input unit 244 of client device122, input that selects “ACCEPT” icon 243B of invitation interface 242.Further, although not illustrated in FIG. 2B, the selection of “ACCEPT”icon 243B may cause display unit 240 to present interface elements thatestablish one or more additional screens of invitation interface 242that prompt user 121 to provide further input specifying one or moreauthentication credentials, such as, but not limited to, a logincredential, an alphanumeric password, or a biometric credential (e.g., athumbprint image, a facial image, etc.).

Further, in some examples (and also not illustrated in FIG. 2B), the oneor more additional display screens of invitation interface may alsoprompt user 121 to provide further input specifying one or more elementsof profile data, or modifying one or more elements of previouslyspecified profile data, that identify and characterize user 121. Forinstance, the elements of profile data may include, but are not limitedto, a full name of user 121, a street address of user 121, contactinformation associated with user 121 (e.g., an email address oftelephone number), demographic data characterizing user 121 (e.g., anage, gender, educational level, etc., of user 121), or one or moretransactional preferences of user 121. Additionally, in some instances,display unit 240 may perform operations that present the one or moreadditional display screens prompting user 101 to specify the element ofprofile data subsequent to the presentation of display screen 243, andprior to the presentation of the one or more additional display screensthat prompt user 121 to specify the authentication credentials.

Referring back to FIG. 2B, input unit 244 may receive input 246 (e.g.,that specifies the selection of “ACCEPT” icon 243B, the one or moreauthentication credentials of user 121, and in some instances, theelements of profile data), and may route input data 248 representativeof the received input to executed wallet application 124. By way ofexample, executed wallet application 124 may parse input data 248 andextract confirmation data 250, which confirm the selection of “ACCEPT”icon 243B by user 121 and an intention of user 121 to accept theinvitation to register for membership within the loyalty program (andfurther, to accept the proffered units of the redeemable andtransferable digital assets). Executed wallet application 124 may alsoparse input data 248 to extract authentication data 252, whichcorrespond to the authentication credentials provided to input unit 244in response to the additional screens of invitation interface 242 (e.g.,presented subsequent to the selection of “ACCEPT” icon 243B). Further,in some instances, executed wallet application 124 may parse input data248 customer profile data 253, which includes the elements of theprofile data specified or modified by user 121.

Executed wallet application 124 may store authentication data 252 and insome instances, confirmation data 250 and customer profile data 253,within a portion of the one or more tangible, non-transitory memories ofclient device 122, e.g., within a credential data store 126. Asillustrated in FIG. 2B, credential data store 126 may also include adevice identifier 254 of client device 102 (e.g., a network address,such as an IP address or MAC address) and an identifier of executedwallet application, such as, but not limited to, application cryptogram256. In some examples, wallet system 130 may generate and provideapplication cryptogram 256 to client device 122 during an initialonboarding process that provisions wallet application 124 to clientdevice 122.

In some examples, and responsive to a detection of confirmation data 250indicative of the acceptance of the invitation, executed walletapplication 124 may perform operations that package authentication data252 (e.g., the authentication credentials provisioned by user 121),application cryptogram 256 (e.g., that identifies executed walletapplication 124), and additionally, or alternatively, device identifier254 (e.g., that identifies client device 122) into corresponding portionof an authentication request 258, which client device 102 may transmitacross network 120 to wallet system 130. As illustrated in FIG. 2B, aprogrammatic interface established and maintained by wallet system 130,such as application programming interface (API) 260 may receiveauthentication request 258, and may programmatic trigger an execution ofan authentication engine 262 by the one or more processors of walletsystem 130 (e.g., based on a generation of one or more electroniccommands). Upon execution by the one or more processors of wallet system130, authentication engine 262 may receive authentication request 258,and may perform operation that parse authentication request 258 toextract authentication data 252, which includes the authenticationcredentials supplied by user 121, application cryptogram 256, and insome instances, device identifier 254.

Executed authentication engine 262 may also access credential data store132 (e.g., as maintained within data repository 131 within the one ormore tangible, non-transitory memories of wallet system 130), and mayidentify one or more data records, such as data record 264, that includeor reference device identifier 254 or application cryptogram 256 and assuch, are associated with executed wallet application 124. In someinstances, executed authentication engine 262 may parse data record 264,extract local authentication credentials 266 associated with executedwallet application 124 and user 121, and authenticate an identity ofuser 121 based on a comparison of authentication data 252 and localauthentication credentials 266.

For example, if executed authentication engine 262 were to detect aninconsistency between authentication data 252 and local authenticationcredentials 266, executed authentication engine 262 may decline toauthenticate the identity of user 121 (not illustrated in FIG. 2B). Insome instances, executed authentication engine 262 may generate an errormessage indicative of the failed authentication, and may performoperations that cause wallet system 130 to transmit the generated errormessage across network 120 to client device 122, e.g., for displaywithin a portion of invitation interface 242 by executed walletapplication 124 (also not illustrated in FIG. 2B).

Alternatively, if executed authentication engine 262 were to establish aconsistency between authentication data 252 and local authenticationcredentials 266, executed authentication engine 262 may authenticate theidentity of user 121, and may perform operations that generate a digitaltoken 268 indicative of the authenticated identity user 121, whichexecuted authentication engine 262 may store within a portion ofcredential data store 132 associated with executed wallet application124, e.g., within or in association with data record 264. In someexamples, digital token 268 may correspond to a one-time-use (OTU) tokenvalid to authenticate the identity of user 121 during a singleregistration, key-regeneration, or digital-asset-allocation,-redemption, or -transfer process, and may be characterized by apredetermined composition, length, or format. The disclosed embodimentsare, however, not limited to OTU tokens, and in other examples, digitaltoken 268 may be valid to authenticate an identity of user 121 during apredetermined temporal period, or for processes initiated within apredetermined geographic region. Executed authentication engine 262 mayperform further processes that cause wallet system 130 to transmitdigital token 268 across network 120 to client device 122, e.g., as aresponse to authentication request 258.

A programmatic interface established and maintained by client device122, such, such as API 238 of executed wallet application 124, mayreceive and route digital token 268 to executed wallet application 124(not illustrated in FIG. 2B). In some instances, executed walletapplication 124 may store digital token 268 within a correspondingportion of credential data store 126, e.g., in association withauthentication data 252, device identifier 254, and applicationcryptogram 256. As described herein, digital token 268 may be indicativeof a successful authentication of the identity of user 121 by walletsystem 130, and based on that successful authentication, executed walletapplication 124 may perform operations that generate a publiccryptographic key 272 and corresponding private cryptographic key 274using one or more appropriate key generation algorithms, such as, butnot limited to a Diffie-Hellman key exchange protocol, a DigitalSignature Standard (DSS) key generation algorithm, or an elliptic-curvealgorithm (e.g., ECDPSA P-256 algorithm based on a random entropicseed), an RSA encryption algorithm, or a homomorphic key generationalgorithm (e.g., a FTFHE scheme, a SEAL encryption scheme, or a PALISADEencryption scheme).

Executed wallet application 124 may store public cryptographic key 272and private cryptographic key 274 within a secure portion of the one ormore tangible, non-transitory memories of client device 122, e.g.,within cryptographic data store 128. In some instances, cryptographicdata store 128 may correspond to a secure enclave or a key store withinthe one or more tangible, non-transitory memories, although in otherinstances, cryptographic data store 128 may represent a hardwaresecurity module (HSM) integrated onto or coupled to client device 122.As described herein, public cryptographic key 272 may be distributed toone or more additional computing systems operating within environment100, such as wallet system 130, gateway system 160, and node systems180, and may represent a unique identifier of both user 121 and executedwallet application 124 within the elements of permissioned distributedledger 190.

Further, and referring to FIG. 2C, executed wallet application 124 mayalso perform operations to that package device identifier 254 (e.g.,that identifies client device 122) and additionally, or alternatively,application cryptogram 256 (e.g., that identifies executed walletapplication 124), into corresponding portion of a challenge request 276,which client device 122 may transmit across network 120 to gatewaysystem 160. As illustrated in FIG. 2B, a programmatic interfaceestablished and maintained by gateway system 160, such as applicationprogramming interface (API) 278 may receive challenge request 276, andmay programmatically trigger an execution of a challenge engine 280 bythe one or more processors of gateway system 160. Upon execution by theone or more processors of gateway system 160, challenge engine 280 mayreceive challenge request 276 and generate a code challenge 282, whichexecuted challenge engine 280 may store in a corresponding portion ofcredential data store 162 in conjunction with device identifier 254and/or application cryptogram 256. In some instances, code challenge 282may correspond to a hash value representative of a portion of theinformation included within challenge request 276 (e.g., a hash valuerepresentative of all or a selected portion of device identifier 254and/or application cryptogram 256), or may correspond to a hash valuerepresentative of a plaintext cipher maintained at gateway system 160.

Executed challenge engine 280 may also perform operations that causegateway system 160 to transmit code challenge 282 across network 120 toclient device 122. As illustrated in FIG. 2B, a programmatic interfaceestablished and maintained by client device 122, such, such as API 238of executed wallet application 124, may receive and route code challenge282 to executed wallet application 124, which may store code challenge282 within a corresponding portion of credential data store 126, e.g.,in association with authentication data 252, device identifier 254,application cryptogram 256, and digital token 268. In some instances,and based on the successful authentication of the identity of user 121by wallet system 130 (e.g., as indicated by digital token 268), and upona receipt of code challenge 282 from gateway system 160, executed walletapplication 124 may perform operations that generate a registrationrequest that, upon successive validation by wallet system 130 andgateway system 160 using any of the exemplary processes describedherein, facilitates a registration of user 121 as a member of theloyalty program and a recordation, within an element of acryptographically secure distributed ledger (e.g., permissioneddistributed ledger 190), of a cryptographic registration object thatuniquely identifies user 101 and executed wallet application 124, asdescribed below in reference to FIGS. 3A-3C.

Referring to FIG. 3A, executed wallet application 124 may accesscredential data store 126, and may obtain digital token 268 (e.g., theOTU token described herein), code challenge 282, device identifier 254of client device 122, and an identifier of executed wallet application124, such as application cryptogram 256. Additionally, executed walletapplication 124 may obtain public cryptographic key 272 fromcryptographic data store 128, and may perform operations that packagepublic cryptographic key 272, digital token 268, and code challenge 282into corresponding portions of a registration request 302. In someinstances, not illustrated in FIG. 3A, executed wallet application 124may also apply a digital signature to code challenge 282 prior topackaging code challenge 282 into registration request 302.

Further, executed wallet application 124 may also generate one or moreelements of registration data 304, which may be packaged into acorresponding portions of registration request 302, e.g., in conjunctionwith public cryptographic key 272, digital token 268, and code challenge282. In some instances, registration data 304 may include applicationcryptogram 256, which uniquely identifies executed wallet application124, and further, device identifier 254, which uniquely identifiesclient device 122. In other instances, registration data 304 may alsoinclude all, or a selected portion of customer profile data 253, e.g.,as maintained within credential data store 126. As described herein,exemplary elements of customer profile data 253 may include, but are notlimited to, a full name of user 121, a street address of user 121,contact information associated with user 121, demographic datacharacterizing user 121, or one or more transactional preferences ofuser 121. In some instances, and as described herein, the elements ofcustomer profile data 253 may include profile data newly specified byuser 121, or alternatively, elements profiled data modified by user 121,based on input provided by user 121 in response to the one or moreadditional display screens of invitation interface 242.

Executed wallet application 124 may also perform operations that apply afirst digital signature 306 to registration request 302 (e.g., to publiccryptographic key 272, digital token 268, code challenge 282, andregistration data 304) using private cryptographic key 274 of executedwallet application 124, as maintained securely within cryptographic datastore 128. In some examples, the application of first digital signature306 to registration request 302 may be indicative of an approval of, anda consent to, the requested registration of user 121 as a member of theloyalty program by both user 101 and executed wallet application 124.Further, certain of the exemplary process described herein, which couplethe application of first digital signature 306 to registration request302 to a level or type of consent granted by user 121 to wallet system130 and/or gateway system 160 to access or manipulate elements ofconfidential data, may be implemented in addition to, or as an alternateto, existing token-based authorization and consent protocols (e.g., anOAuth protocol, etc.) during the registration processes implementedcollectively by client device 122, wallet system 130, and gateway system160.

Executed wallet application 124 may also perform operations that causeclient device 122 to transmit registration request 302, first digitalsignature 306, and in some instances, a public key certificate 308 ofclient device 122 (which includes public cryptographic key 272) acrossnetwork 120 to wallet system 130. As illustrated in FIG. 3A, a secure,programmatic interface established and maintained by wallet system 130,such as application programming interface (API) 310, may receiveregistration request 302, first digital signature 306, and in someinstances, a public key certificate 308, and may programmaticallytrigger an execution of a registration engine 312 by the one or moreprocessors of wallet system 130.

For example, a verification module 314 of executed registration engine312 may receive registration request 302 (e.g., that includes publiccryptographic key 272, digital token 268, code challenge 282, andregistration data 304), first digital signature 306, and public keycertificate 308 from API 310. In some instances, verification module 314may parse public key certificate 308 and obtain a public cryptographickey associated client device 122 (e.g., public cryptographic key 272 ofexecuted wallet application 124), and perform operations that verifyfirst digital signature 306 based on the obtained public cryptographickey. If, for example, verification module 314 were unable to verifyfirst digital signature 306, verification module 314 may establish thatregistration request 302 was either corrupted during transmission ofaltered one or more third parties without permission, and executedregistration engine 312 may decline to further process registrationrequest 302. In some instances (not illustrated in FIG. 3A), executedregistration engine 312 may generate an error message, and wallet system130 may transmit the generated error message across network 120 toclient device 122, e.g., for presentation within a display screen ofinvitation interface 242.

Alternatively, if verification module 314 were to verify first digitalsignature 306, verification module 314 may perform operations thatobtain, from registration request 302, digital token 268 and all or aselected portion of registration data 304, which includes deviceidentifier 254 and application cryptogram 256. In some instances,verification module 314 may access credential data store 132, andidentify one or more data records 315 that include or reference deviceidentifier 254 or application cryptogram 256, and as such, as associatedwith client device 122 or executed wallet application 124. Asillustrated in FIG. 3A, verification module 314 may obtain, from datarecords 315, a local digital token 316 indicative of a currently validauthentication of the identity of user 121, and perform operations thatdetermine whether digital token 268 (e.g., as received from clientdevice 122) is consistent with, and corresponds to, local digital token316. If, for example, verification module 314 were to detect aninconsistency between digital token 268 and local digital token 316,executed registration engine 312 may decline to further processregistration request 302 and may generate an error message, which walletsystem 130 may transmit across network 120 to client device 122, e.g.,for presentation within a display screen of invitation interface 242(not illustrated in FIG. 3A).

In other examples, based on the verification of first digital signature306, and based on the determined consistency between digital token 268and local digital token 316, verification module 314 may verifyregistration request 302 for further processing, and may provideregistration request 302, first digital signature 306, and in someinstances, a public key certificate 308 and as input to a consent module318 of executed registration engine 312. Verification module 314 mayalso perform operations that store all or a selected portion ofregistration data 304, such as the one or more elements of customerprofile data 253, within a corresponding portion of credential datastore 132, e.g., within, or in association with, the one or more datarecords 315.

Consent module 318 may receive registration request 302, first digitalsignature 306, and public key certificate 308, and may obtain a publiccryptographic key 320 and a corresponding private cryptographic key 322of wallet system 130 from cryptographic data store 134. Public andprivate cryptographic keys 320 and 322 may establish an asymmetric keypair or wallet system 130, which may be generated using one or more ofthe key generation algorithms described herein, and public cryptographickey 320 may be distributed to one or more additional or alternatecomputing systems and devices operating within environment 100, such as,but not limited to, program system 140 or gateway system 160.

In some instances, consent module 318 may perform operations that applya second digital signature 324 to registration request 302 (e.g., thatincludes public cryptographic key 272, digital token 268, code challenge282, and registration data 304) and to first digital signature 306 usingprivate cryptographic key 322 of wallet system 130. As described herein,the application of second digital signature 324 to registration request302 and to first digital signature 306 may indicative of an approval of,and a consent to, the requested registration of user 121 as a member ofthe loyalty program by executed registration engine 312 and as such, bywallet system 130, and executed registration engine 312 may performoperations that cause wallet system 130 to transmit registration request302, first digital signature 306, second digital signature 324, publickey certificate 308 of client device 122 (e.g., that includes publiccryptographic key 272) and a public key certificate 326 (e.g., thatincludes public cryptographic key 320) across network 120 to gatewaysystem 160.

Referring to FIG. 3B, a programmatic interface establish and maintainedby gateway system 160, such as application programming interface (API)328, may receive registration request 302, first digital signature 306,second digital signature 324, and public key certificate 308 and 326,and may perform operations that trigger an execution of a verificationengine 330 by the one or more processors of gateway system 160. In someinstances, executed verification engine 330 may parse public keycertificate 308 to extract public cryptographic key 272 of executedwallet application 124, and may parse public key certificate 326 toextract public cryptographic key 320 of wallet system 130. Executedverification engine 330 may perform operations that validate seconddigital signature 324 (e.g., as applied to registration request 302 andfirst digital signature 306) using public cryptographic key 320 ofwallet system 130 and further, that validate first digital signature 306(e.g., as applied to registration request 302) using publiccryptographic key 272 of executed wallet application 124.

If, for example, executed verification engine 330 were unable to verifyfirst digital signature 306, and additionally, or alternatively, seconddigital signature 324, executed verification engine 330 may decline therequested registration of user 121 as a member of the loyalty program,and may discard registration request 302. In some instances (notillustrated in FIG. 3B), executed verification engine 330 may generatean error message, and gateway system 160 may transmit the generatederror message across network 120 to client device 122, e.g., forpresentation within a display screen of invitation interface 242 (notillustrated in FIG. 3B)

Alternatively, if executed verification engine 330 were to verify firstdigital signature 306 and second digital signature 324, executedverification engine 330 may perform operations that obtain, fromregistration request 302, code challenge 282 and all or a selectedportion of registration data 304, which includes device identifier 254and application cryptogram 256. In some examples, executed verificationengine 330 may access credential data store 162, and identify one ormore data records 332 that include or reference device identifier 254 orapplication cryptogram 256, and as such, as associated with clientdevice 122 or executed wallet application 124. As illustrated in FIG.3B, executed verification engine 330 may obtain, from data records 332,a local code challenge 334 (e.g., generated using any of the exemplaryprocesses described herein), and perform operations that determinewhether code challenge 282 (e.g., as received from client device 122) isconsistent with, and corresponds to, local code challenge 334.

As described herein, code challenge 282 may also be associated with anadditional digital signature applied to code challenge 282 by executedwallet application 124 using private cryptographic key 274. In someinstances, not illustrated in FIG. 3B, executed verification engine 330may perform any of the exemplary processes described herein to validatethe additional digital signature applied to code challenge 282 prior todetermining the consistency and correspondence between code challenge282 and local code challenge 334.

If, for example, executed verification engine 330 were to detect aninconsistency between code challenge 282 and local code challenge 334(and in some instances, were unable to validate the additional digitalsignature applied to code challenge 282), executed verification engine330 may decline the requested registration of user 121 as a member ofthe loyalty program, and may discard registration request 302. In someinstances (not illustrated in FIG. 3B), executed verification engine 330may perform any of the exemplary processes described herein to generateand transmit an error message across network 120 to client device 122,e.g., for presentation within a display screen of invitation interface242. Alternatively, based on the validation of first digital signature306 and second digital signature 324 (and in some instances, thevalidation of the additional digital signature applied to code challenge282), and based on the determined consistency between code challenge 282and local code challenge 334, executed verification engine 330 mayapprove the requested registration of user 121 as a member of theloyalty program, e.g., based on the prior approval of, and consent to,the requested registration by user 121 and wallet system 130, asindicated by respective ones of now-validated first and second digitalsignatures 306 and 324.

As illustrated in FIG. 3B, executed verification engine 330 may provideapproved registration request 302 as an input to a distributedregistration engine 336 executed by the one or more processors ofgateway system 160. In some examples, executed distributed registrationengine 336 may perform operations that parse registration request 302 toextract public cryptographic key 272 of executed wallet application 124,and further to extract registration data 304, which includes deviceidentifier 254, application cryptogram 256, and the one or more elementsof customer profile data 253. Further, executed distributed registrationengine 336 may perform operations that package public cryptographic key272 and all, or a selected portion, of registration data 304, intocorresponding portions of a registration object 338 associated with user121 and executed wallet application 124, and that apply a digitalsignature 340 to registration object 338 using a private cryptographickey 342 of gateway system 160, e.g., as maintained within cryptographicdata store 164.

In some instances, gateway system 160 to broadcast registration object338, digital signature 340, and public key certificate 344 of gatewaysystem 160 (that includes a public cryptographic key 346 of gatewaysystem 160 across network 120 to one or more of node systems 180, suchas node system 182, which may perform any of the exemplary processesdescribed herein to record registration object 338 within one or moreelements of a distributed ledger, such as an updated version ofpermissioned distributed ledger 190. As described herein, uponrecordation of registration object 338 within the one or more elementsof the distributed ledger, user 121 may be registered as a member of theloyalty program, and public cryptographic key 272 may function as aunique identifier of user 121 during exchanges of data associated withthe loyalty program and involving executed wallet application 124,wallet system 130, program system 140, and gateway system 160.

For example, and as illustrated in FIG. 3B, a programmatic interfaceestablished and maintained by each of node systems 180, such asapplication programming interface (API) 348 of node system 182, mayreceive registration object 338, digital signature 340, and public keycertificate 344 from gateway system 160, and may route registrationobject 338, digital signature 340, and public key certificate 344 to acorresponding block generation engine, such as block generation engine350 of node system 182. When executed by the one or more processors ofnode system 182 (and each additional or alternate one of node systems180), block generation engine 350 may perform operations that verifydigital signature 340 using public cryptographic key 346 (e.g., asobtained from public key certificate 344), that generate an additionalelement 352 of permissioned distributed ledger 190 that, among otherthings, includes registration object 338, e.g., public cryptographic key272 of executed wallet application 124 and all, or the selected portionof, registration data 304.

In some instances, executed block generation engine 350 (and the blockgeneration engine executed by additional ones of node systems 180) mayperform operations that generate and apply a digital signature 351 toregistration object 338 (e.g., using a corresponding privatecryptographic key of node system 182), and that generate a hash value354 based on an application of one or more appropriate hash algorithmsto registration object 338 and digital signature 351 (and in someinstances, to other elements of distributed ledger 190). Executed blockgeneration engine 350 may package digital signature 351 and hash value354 into corresponding portions of additional element 352, e.g., inconjunction with registration object 338.

Further, node system 182 (and each additional or alternate one of nodesystems 180) may perform operations that append additional element 352to a prior version of the permissioned distributed ledger (e.g.,permissioned distributed ledger 190) to generate a latest, longestversion of the permissioned distributed ledger, e.g., an updateddistributed ledger 356. In some instances, node system 182 (and eachadditional or alternate one of node systems 180), may also generate andassign an identifier 352A to the additional element, such as apositional identifier (e.g., a “block number”) that specifies asequential position of additional element 352 relate to the existing,prior elements of the distributed ledger. These additional operationsmay, for example, be established through a distributed consensus amongadditional ones of node systems 180, and may include, but are notlimited to, the calculation of an appropriate proof-of-work orproof-of-stake by a distributed consensus module 358 prior to the otherpeer systems. In certain aspects, node system 182 may broadcast evidenceof the calculated proof-of-work or proof-of-stake to additional ones ofnode systems 180 across network 120 (not illustrated in FIG. 3B).

Node system 182 may also broadcast distributed ledger 356, whichrepresents the latest, longest version of the distributed ledger, to theadditional ones of node systems 180 operating within environment 100 andadditionally or alternatively, to each of the network-connected systemsthat participate in the permissioned, distributed-ledger networkdescribed herein, such as gateway system 160. In some instances, notillustrated in FIG. 3B, executed distributed registration engine 336 ofgateway system 160 may store distributed ledger 356 within a portion ofthe one or more tangible, non-transitory memories, such as datarepository 161 (e.g., to replace permissioned distributed ledger 190),and may generate a confirmation message 362 that includes all or aselected portion of registration object 338, such as, but not limitedto, public cryptographic key 272 of executed wallet application 124 orelement identifier 352A. Executed distributed registration engine 336may perform operations that cause gateway system 160 to transmit, viawallet system 130, confirmation message 362 across network 120 to clientdevice 102, which generated response data 230 referring user 121 to theloyalty program, and to client device 122, which generated registrationrequest 302 accepting the referred invitation and requestingregistration within the loyalty program.

Although not illustrated in FIGS. 3A and 3B, executed wallet application104 (e.g., at client device 102) may perform operations that presentinterface elements representative of all or a portion of confirmationmessage 362 within a corresponding portion of referral interface 220,and further, executed wallet application 104 (e.g., at client device102) may perform operations that present interface elementsrepresentative of all or a portion of confirmation message 362 within acorresponding portion of referral interface 220. As described herein,user 101 may elect to refer user 121 to the loyalty program, and user121 may accept an invitation to register as a member of the loyaltyprogram, in exchange for a redeemable or transferable digital asset, orpredetermined number of units of that digital asset, proffered byprogram system 140 as part of an ongoing referral campaign of theloyalty program. In some examples, and based on the receipt ofconfirmation message 362, executed wallet application 104 andadditionally, or alternatively, executed wallet application 124, mayperform any of the exemplary processes described herein to request, inconjunction with wallet system 130 and gateway system 160, an allocationof the proffered digital asset and a recordation of a correspondingallocation object with one or more elements of distributed ledger 356,e.g., in conjunction with the public cryptographic key of a respectiveone of executed wallet application.

FIGS. 4A and 4B are flowcharts of exemplary processes for securelydistributing, and managing the distribution of, cryptographic keyswithin a computing environment using permissioned distributed ledgers,in accordance with the disclosed embodiments. In some examples, acomputing system capable of provisioning and supporting walletapplications executed by computing devices within the computingenvironment, such as wallet system 130, may perform one or more of theexemplary steps of process 400, as described below in reference to FIG.4A. Further, a computing system associated with permissioned,distributed-ledger network operating within the environment, such asgateway system 160, may perform one or more of the exemplary steps ofprocess 450, as described below in reference to FIG. 4B.

Referring to FIG. 4A, wallet system 130 may receive, from a clientdevice (e.g., client device 102 or client device 122 of FIG. 1) acrossnetwork 120, a request for a registration of a user of the client device(e.g. user 101 or user 121 of FIG. 1) and a first digital signature(e.g., in step 402). As described herein, the registration request maybe generated by a wallet application executed by the client device(e.g., executed wallet application 104 or executed wallet application124), and the registration request may include, among other things, apublic cryptographic key that uniquely identifies the executed walletapplication, a digital token generated by wallet system 130 in responseto a successful authentication of an identity of the user (e.g., aone-time-user (OTU) token), and a code challenge generated by gatewaysystem 160. Further, as also described herein, the registration requestmay also include registration data that includes, but is not limited to,a device identifier of the client device (e.g., a network address, suchas an IP address), an identifier of the executed wallet application(e.g., an application cryptogram), and one or more elements of profiledata characterizing the user.

Further, as also described herein, the wallet application executed bythe client device may apply the first digital signature to theregistration request, e.g., using a corresponding private cryptographickey of the executed wallet application. In some instances, theapplication of the first digital signature to the registration requestby the executed wallet application may be indicative of an approval ofand consent to the requested registration by the user of the clientdevice.

Wallet system 130 may perform any of the exemplary processes describedherein to validate the applied first digital signature (e.g., in step404). If wallet system 130 were unable to verify the first digitalsignature, (e.g., step 404; NO), wallet system 130 may decline therequested registration (e.g., in step 406). Wallet system 130 mayperform any of the exemplary processes described herein to generate anerror message, and may transmit the generated error message to theclient device (e.g., in step 408). Exemplary process 400 is thencomplete in step 410.

Alternatively, if wallet system 130 were to verify the first digitalsignature (e.g., step 404; YES), wallet system 130 may parse theregistration request to extract the digital token (e.g., the OTU token)from the registration request (e.g., in step 411), and may perform anyof the exemplary processes described herein to verify the extracteddigital token is consistent with, and corresponds to, a locallymaintained copy of the digital token provisioned to the client device(e.g., in step 412). If, for example, wallet system 130 were to detectan inconsistency between the extracted digital token and the local copyof the digital token (e.g., step 412; NO), exemplary process 400 maypass back to step 406, and wallet system 130 may decline the requestedregistration of the user as a member of the loyalty program.

Alternatively, if wallet system 130 were to establish a consistency, anda correspondence, between the extracted digital token and the locallymaintained copy of the digital token (e.g., step 412; YES), walletsystem 130 may approve, and consent to, the requested registration ofthe user as a member of the loyalty program (e.g., in step 414).Further, wallet system 130 may perform any of the exemplary processesdescribed herein to apply a second digital signature to the registrationrequest and to the first digital signature (e.g., in step 416). Asdescribed herein, the application of the second digital signature to theregistration request and to the first digital signature may indicativeof an approval of, and a consent to, the requested registration of theuser as a member of the loyalty program by wallet system 130.

In some instances, wallet system 130 may transmit the registrationrequest, the first digital signature, and the second digital signatureacross network 120 to a computing system associated with, and thatparticipates in, the permissioned, distributed-ledger network describedherein, such as gateway system 160 (e.g., in step 418). Exemplaryprocess 400 is then complete in step 410.

Referring to FIG. 4B, gateway system 160 may receive the registrationrequest, the first digital signature, and the second digital signaturefrom wallet system 130 (e.g., in step 452). In some instances, in step454, gateway system 160 may perform any of the exemplary processesdescribed herein to validate the first and second digital signatures. Ifgateway system 160 were unable to validate the first digital signatureor the second digital signature, (e.g., step 454; NO), gateway system160 may decline the requested registration (e.g., in step 456). Gatewaysystem 160 may perform any of the exemplary processes described hereinto generate an error message indicative of the failed verification ofthe first digital signature and the declined request, and may transmitthe generated error message to the client device via wallet system 130(e.g., in step 458). Exemplary process 450 is then complete in step 460.

Alternatively, if gateway system 160 were to verify both the first andsecond digital signatures (e.g., step 454; YES), gateway system 160 mayparse the registration request to extract the code challenge from theregistration request (e.g., in step 461), and may perform any of theexemplary processes described herein to verify the extracted codechallenge is consistent with, and corresponds to, a locally maintainedcopy of the code challenge provisioned to the client device (e.g., instep 462). If, for example, gateway system 160 were to detect aninconsistency between the extracted code challenge and the local copy ofthe code challenge (e.g., step 462; NO), exemplary process 450 may passback to step 456, and gateway system 160 may decline the requestedregistration.

Alternatively, if gateway system 160 were to establish a consistency,and a correspondence, between the extracted code challenge and thelocally maintained copy of the code challenge (e.g., step 462; YES),gateway system 160 may approve, and consent to, the requestedregistration of the user as a member of the loyalty program (e.g., instep 464). Gateway system 160 may also perform any of the exemplaryprocesses described herein to generate a registration object associatedwith the now-approved registration request, and to apply any additionaldigital signature to the registration object (e.g., in step 466).

Further, gateway system 160 may also perform any of the exemplaryprocesses described herein, in conjunction with one or more node systemsoperating within the computing environment, to record immutably theregistration object within an element of a cryptographically secure,permissioned distributed ledger, such as within element 352 of updateddistributed ledger 356 of FIG. 3B (e.g., in step 468). In someinstances, and as described herein, gateway system 160 may receive aconfirmation message indicative of the recordation of the registrationobject within the element of the distributed ledger, and may route theconfirmation message back to the client device via wallet system 130(e.g., in step 470). Exemplary process 450 is then complete in step 460.

C. Secure Distribution of Digital Assets within a Computing EnvironmentUsing Permissioned Distributed Ledgers

Through an implementation of certain of the exemplary processesdescribed herein, a wallet application executed at a first client device(e.g., wallet application 104 executed at client device 102) may performoperations that enable a current member of a loyalty program associatedwith a financial institution (e.g., user 101) to refer an additionalcustomer of that financial institution (e.g., user 121) for membershipin exchange for a proffered allocation of a redeemable and transferrabledigital asset, or a predetermined quantity of that digital asset, withinan referral campaign administered by program system 140 of the loyaltyprogram. Further, and based on invitation data generated by a programsystem 140, a wallet application executed at a second client deviceoperable by user 121 (e.g., wallet application 124 executed at clientdevice 122) may enable user 121 to accept an invitation for membershipin exchange for a further allocation of the digital asset, or apredetermined quantity of that digital asset, within the referralcampaign, and may perform operations that generate a request forregistration in the loyalty program, which executed wallet application124 may transmit to a computing system that provisions and supports notonly executed wallet application 124, but also executed walletapplication 104, e.g., wallet system 130 of FIG. 1.

As described herein, the registration request may include an element ofcryptographic data, e.g., public cryptographic key 272, that uniquelyidentifies not only user 121, but also executed wallet application 124,in exchanges of data between computing devices and systems ofenvironment 100 that involve, or are associated with, the loyaltyprogram, and executed wallet application 124 may also apply a firstdigital signature to the registration request, which indicates anapproval of, and a consent to, the requested registration by user 101.Upon validation of the applied first digital signature, wallet system130 may perform any of the exemplary processes described herein toapprove and consent to the registration requested by user 121, to applya second digital signature to the registration request and to the firstdigital signature, which confirms the approval of and consent to therequested registration of user 121 into the loyalty program by walletsystem 130. Further, and as described herein, wallet system 130 maytransmit the registration request, the first digital signature (e.g.,that confirms the approval of and the consent to the requestedregistration by user 121), and the second digital signature (e.g., thatconfirms the approval of and the consent to the requested registrationby wallet system 130) to one or more gateway systems of a permissioned,distributed-ledger network associated with the loyalty program, such asgateway system 160 of FIG. 1.

In some instances, gateway system 160 may perform any of the exemplaryprocesses described herein to validate the first and second digitalsignature, and as such, to confirm the prior grant of approval of, andconsent to, the requested registration by user 101 and wallet system130. Based on the confirmation of each of the prior grants of approvaland consent, gateway system 160 may generate a registration object(e.g., registration object 338 of FIG. 3B) that includes publiccryptographic key 272 of executed wallet application 124 and additionalelements of registration data that identify and characterize user 121,client device 122, or executed wallet application 124. As describedherein, gateway system 160 may broadcast the generated registrationrequest to one or more node systems that are associated with, andoperated within, the permissioned distributed-ledger network describedherein (e.g., node systems 180, including node system 182, of FIG. 1),and the one or more node systems may implement any of the exemplaryprocesses described herein to record the registration object within anelement of cryptographically secure distributed ledger, e.g., element352 of updated distributed ledger 356, which the one or more nodesystems may broadcast to each computing system operating within thepermissioned distributed-ledger network, such as gateway system 160 andadditional ones of node systems 180.

As described herein, the recordation of registration object 338 withinelement 352 of updated distributed ledger 356 may be indicative of thesuccessful registration of user 121 as a member of the loyalty program.Further, the elements of updated distributed ledger 356 (and of theadditional or alternate exemplary distributed ledgers described herein),when queried using public cryptographic key 272 of executed walletapplication 124, establishes an immutable and time evolving record ofall interactions between user 121 and the loyalty program (e.g., throughrequests for key regeneration, asset allocation, or asset redemption)and between user 121 and other members of the loyalty program and ofother unrelated loyalty programs (e.g., through requests forpeer-to-peer transactions). Certain of these exemplary processes, whichestablish an immutable, auditable, and cryptographically secure recordof customer interaction with one or more loyalty programs based on arecordation of a cryptographic, customer-specific identifier onto apermissioned distributed ledger, may be implemented in addition to, oras an alternate to, existing loyalty programs that track customerinteractions using accrued, program-specific points using potentiallyinsecure program-specific relational databases.

Responsive to the successful recordation of registration object 338within element 352 of updated distributed ledger 356, gateway system 160may perform any of the exemplary processes described herein to generateand transmit a confirmation message (e.g. confirmation message 362 ofFIG. 3B) across network 120 to not only client device 122 (e.g., asoperated by newly registered user 121), but also to client device 102(e.g., as operated by user 101, which referred user 121 to the loyaltyprogram). As described below in reference to FIGS. 5A and 5B, each ofclient devices 102 and 122 may receive confirmation message 362, andrespective ones of executed wallet applications 104 and 124 may performoperations that generate and present interface elements representativeof confirmation message 362 within a corresponding portion of a digitalinterface, such as a respective one of referral interface 220 orinvitation interface 242.

Further, and as described herein, user 101 may elect to refer user 121to the loyalty program, and user 121 may accept an invitation toregister as a member of the loyalty program, in exchange for aredeemable or transferable digital asset, or predetermined number ofunits of that digital asset, proffered by program system 140 as part ofan ongoing referral campaign of the loyalty program. In some examples,described below in reference to FIGS. 5A and 5B, executed walletapplication 104 and additionally, or alternatively, executed walletapplication 124, may perform any of the exemplary processes describedherein to request, in conjunction with wallet system 130 and gatewaysystem 160, an allocation of the proffered digital asset and arecordation of a corresponding allocation object with one or moreelements of distributed ledger 356, e.g., in conjunction with the publiccryptographic key of a respective one of executed wallet application.Additionally, one or more of the exemplary allocation processes, asdescribed herein, may be initiated and implemented by executed walletapplication 104 and by executed wallet application 124 automaticallyupon receipt of confirmation message 362 and without intervention orinput from a respective one of user 101 or 121.

Referring to FIG. 5A, a secure, programmatic interface established andmaintained by client device 102, such as application programminginterface (API) 502 of executed wallet application 104, may receive androute confirmation message 362 to executed wallet application 104. Insome examples, executed wallet application 104 may perform operationsthat store confirmation message 362 within a corresponding portion ofthe one or more tangible, non-transitory memories of client device 102,such as, but not limited to, a portion of credential data store 106. Asillustrated in FIG. 5A, client device 102 may also maintain, withincredential data store 106, authentication data 504 (e.g., that specifiesone or more authentication credentials that enable user 101 to accessexecuted wallet application 104), a device identifier 506 of clientdevice 102 (e.g., a network address, such as an IP address or a MACaddress), and a unique identifier of executed wallet application 104,such as an application cryptogram 508.

For example, the one or more authentication credentials may include, butare not limited to, a login credential of user 101, an alphanumericpassword of user 101, and one or more biometric credentials, such as afacial image or a thumbprint image, the user 101 may provision the oneor more authentication credentials to client device 102 (e.g., via acorresponding input unit) during a prior authentication of user 101'sidentity involving executed wallet application 104 and/or wallet system130, e.g., using any of the exemplary processes described herein.Further, wallet system 130 may generate and provide applicationcryptogram 508 to client device 102 during an initial onboarding processthat provisions wallet application 104 to client device 102.

Additionally, and as illustrated in FIG. 5A, client device 102 may alsomaintain, within credential data store 106, one or more elements ofcustomer profile data 510. The one or more elements of customer profiledata 510 may include, but are not limited to, a full name of user 101, astreet address of user 101, contact information associated with user 101(e.g., a preferred email address of telephone number), demographic datacharacterizing user 101 (e.g., an age, gender, educational level, etc.,of user 101), or one or more transactional preferences of user 101. Insome instances, executed wallet application 104 may obtain the one ormore elements of customer profile data 510, and may store the one ormore elements of customer profile data 510 within credential data store106, using any of the exemplary processes described herein, such as, butnot limited, based on input received from one or more additional displayscreens of referral interface 220 or through an initial authenticationof user 101 with executed wallet application 104 or with wallet system130.

Executed wallet application 104 may also perform any of the exemplaryauthentication processes described herein to request, and obtain, adigital token 512 from wallet system 130, e.g., in response to asuccessful authentication process between executed wallet application104 and one or more application programs, engines, or modules executedby the one or more processors of wallet system 130. Executed walletapplication 104 may also perform operations that store digital token 512within a portion of the one or more tangible, non-transitory memories ofclient device 102, e.g., within a portion of credential data store 126associated with authentication data 504, device identifier 506, andapplication cryptogram 508. For example, digital token 512 maycorrespond to a one-time-use (OTU) token valid to authenticate theidentity of user 101 during a single registration, key-regeneration, ordigital-asset-allocation, -redemption, or -transfer process, and may becharacterized by a predetermined composition, length, or format. Thedisclosed embodiments are, however, not limited to OTU tokens, and inother examples, digital token 512 may be valid to authenticate anidentity of user 101 during a predetermined temporal period, or forprocesses initiated within a predetermined geographic region.

Further, and based on that successful authentication, executed walletapplication 124 may perform any of the exemplary processes describedherein to perform operations that generate a public cryptographic key518 and a corresponding private cryptographic key 520 for executedwallet application 104 using one or more appropriate key generationalgorithms. Examples of these key generation algorithms include, but arenot limited to, a Diffie-Hellman key exchange protocol, a DigitalSignature Standard (DSS) key generation algorithm, or an elliptic-curvealgorithm (e.g., ECDPSA P-256 algorithm based on a random seed, such asentropy), or an RSA encryption algorithm, or a homomorphic keygeneration algorithm (e.g., a FTFHE scheme, a SEAL encryption scheme, ora PALISADE encryption scheme). Executed wallet application 104 may storepublic cryptographic key 518 and private cryptographic key 520 within asecure portion of the one or more tangible, non-transitory memories ofclient device 122, e.g., within cryptographic data store 108.

In some instances, cryptographic data store 108 may correspond to asecure enclave or a key store within the one or more tangible,non-transitory memories, although in other instances, cryptographic datastore 128 may represent a hardware security module (HSM) integrated ontoor coupled to client device 102. As described herein, publiccryptographic key 518 may be distributed to one or more additionalcomputing systems operating within environment 100, such as walletsystem 130, gateway system 160, and node systems 180, and may representa unique identifier of both user 101 and executed wallet application 104within the elements of distributed ledger 190 or updated distributedledger 356.

Further, executable wallet application 104 may also perform any of theexemplary processes described herein to request and receive a codechallenge 522 from gateway system 160, which executed wallet application104 may store within a portion of credential data store 106 associatedwith authentication data 504, device identifier 506, applicationcryptogram 508, and digital token 512. In some instances, code challenge522 may be generated by gateway system 160 using any of the exemplaryprocesses described herein, and correspond to a hash valuerepresentative of all or a selected portion of device identifier 506and/or application cryptogram 508, or may correspond to a hash valuerepresentative of a plaintext cipher maintained confidentially bygateway system 160.

In some examples, and responsive to the receipt of confirmation message362, which confirms the successful referral of user 121 for membershipin the loyalty program and the recordation of registration object 338within element 352 of updated distributed ledger 356, executed walletapplication 104 may perform operations that generate a request 524 foran allocation of the proffered digital asset, of the proffered quantityof that digital asset, to user 101 in response to the successfulreferral of user 121 for membership in the loyalty program. By way ofexample, executed wallet application 104 may package, into correspondingportions of allocation request 524, one of more of: (i) publiccryptographic key 518, which uniquely identifies user 101 and executedwallet application 104); (ii) all or a selected portion of confirmationmessage 368, such as element identifier 352A and now-recorded publiccryptographic key 272 of referred user 121 and wallet application 124;(iii) digital token 512 (e.g., the OTU token described herein); (iv)code challenge 522, e.g., as received from gateway system 160; and (v)one or more of device identifier 506 (e.g., the IP address of clientdevice 102) or application cryptogram 508. In some instances, notillustrated in FIG. 5A, executed wallet application 104 may also apply adigital signature to code challenge 522 prior to packaging codechallenge 522 into a corresponding portion of allocation request 524.

Executed wallet application 104 may also perform operations that apply afirst digital signature 526 to allocation request 524 using privatecryptographic key 520 of executed wallet application 104, as maintainedsecurely within cryptographic data store 108. In some examples, theapplication of first digital signature 526 to allocation request 524 maybe indicative of an approval of, and a consent to, the requestedallocation of the digital asset, or the quantity of digital assets, touser 101 in response to the successful referral of user 121 formembership in the loyalty program. Further, certain of the exemplaryprocess described herein, which couple the application of first digitalsignature 526 to allocation request 524 to a level or type of consentgranted by user 101 to wallet system 130 and/or gateway system 160 toaccess, manipulate, or store confidential registration or allocationdata, may be implemented in addition to, or as an alternate to, existingtoken-based authorization and consent protocols (e.g., an OAuthprotocol, etc.) during the asset-allocation processes implementedcollectively by client device 102, wallet system 130, and gateway system160.

Executed wallet application 104 may also perform operations that causeclient device 102 to transmit allocation request 524, first digitalsignature 526, and in some instances, a public key certificate 528 ofclient device 102 (which includes public cryptographic key 518) acrossnetwork 120 to wallet system 130. As illustrated in FIG. 5A, aprogrammatic interface established and maintained by wallet system 130,such as API 310, may receive allocation request 524, first digitalsignature 526, and in some instances, public key certificate 528, andmay programmatically trigger an execution of an allocation engine 530 bythe one or more processors of wallet system 130.

For example, a verification module 532 of executed allocation engine 530may receive allocation request 524, first digital signature 526, andpublic key certificate 528 from API 310. In some instances, verificationmodule 532 may parse public key certificate 528 and obtain a publiccryptographic key associated client device 102 (e.g., publiccryptographic key 518 of executed wallet application 104), and performoperations that verify first digital signature 526 based on the obtainedpublic cryptographic key. If, for example, verification module 532 wereunable to verify first digital signature 526, verification module 532may establish that allocation request 524 was either corrupted duringtransmission of altered one or more third parties without permission,and executed allocation engine 530 may decline the requested allocation.In some instances (not illustrated in FIG. 5A), executed allocationengine 530 may generate and transmit an error message across network 120to client device 102, e.g., for presentation within a correspondingdigital interface, such as referral interface 220.

Alternatively, if verification module 532 were to verify first digitalsignature 526, verification module 532 may perform operations thatobtain device identifier 506, application cryptogram 508, and digitaltoken 512 from allocation request 524, and may identify one or more datarecords 534 within credential data store 132 that include or referencedevice identifier 506 or application cryptogram 508, and as such, areassociated with client device 102 or executed wallet application 104. Asillustrated in FIG. 5A, verification module 532 may obtain, from datarecords 534, a local digital token 536, which is indicative of acurrently valid authentication of the identity of user 101, and performoperations that determine whether digital token 512 (e.g., as receivedfrom client device 102) is consistent with, and corresponds to, localdigital token 536. If, for example, verification module 532 were todetect an inconsistency between digital token 512 and local digitaltoken 536, executed allocation engine 530 may decline the requestedallocation and may generate an error message, which wallet system 130may transmit across network 120 to client device 102, e.g., forpresentation within a display screen of referral interface 220.

Alternatively, based on the verification of first digital signature 526,and based on the determined consistency between digital token 512 andlocal digital token 536, verification module 532 may approve therequested allocation and verify allocation request 524 for furtherprocessing, e.g., by gateway system 160. In some instances, verificationmodule 532 may provide allocation request 524, first digital signature526, and in some instances, public key certificate 528 and as input to aconsent module 538 of executed allocation engine 530. As illustrated inFIG. 5A, consent module 538 may receive allocation request 524, firstdigital signature 526, and public key certificate 528, and may obtainpublic cryptographic key 320 and corresponding private cryptographic key322 of wallet system 130 from cryptographic data store 134.

In some instances, consent module 538 may perform operations that applya second digital signature 540 to allocation request 524 (e.g., thatincludes public cryptographic key 518, all or the selected portion ofconfirmation message 362, digital token 512, code challenge 522, deviceidentifier 506 and/or application cryptogram 508) and to first digitalsignature 526. As described herein, the application of second digitalsignature 540 to allocation request 524 and to first digital signature526 may indicative of an approval of, and a consent to, the requestedallocation by wallet system 130, and executed allocation engine 530 mayperform operations that cause wallet system 130 to transmit allocationrequest 524, first digital signature 526, second digital signature 540,public key certificate 528 of client device 102 (e.g., that includespublic cryptographic key 518) and public key certificate 326 (e.g., thatincludes public cryptographic key 320) across network 120 to gatewaysystem 160.

Referring to FIG. 5B, a programmatic interface establish and maintainedby gateway system 160, such as API 328, may receive allocation request524, first digital signature 526, second digital signature 540, andpublic key certificates 326 and 528, and may perform operations thattrigger an execution of verification engine 330 by the one or moreprocessors of gateway system 160. In some instances, executedverification engine 330 may parse public key certificate 528 to extractpublic cryptographic key 518 of executed wallet application 104, and mayparse public key certificate 326 to extract public cryptographic key 320of wallet system 130. Executed verification engine 330 may performoperations that validate second digital signature 540 (e.g., as appliedto allocation request 524 and first digital signature 526) using publiccryptographic key 320 and further, that validate first digital signature526 (e.g., as applied to allocation request 524) using publiccryptographic key 518.

If, for example, executed verification engine 330 were unable to verifyfirst digital signature 526, and additionally, or alternatively, seconddigital signature 540, executed verification engine 330 may decline therequested allocation, and may discard allocation request 524. In someinstances (not illustrated in FIG. 5B), executed verification engine 330may generate and transmit an error message across network 120 to clientdevice 102, e.g., for presentation within a display screen of referralinterface 220.

Alternatively, if executed verification engine 330 were to verify firstdigital signature 526 and second digital signature 540, executedverification engine 330 may perform operations that obtain, fromallocation request 524, code challenge 522, device identifier 506,and/or application cryptogram 508. In some examples, executedverification engine 330 may access credential data store 162, andidentify one or more data records 542 that include or reference deviceidentifier 506 or application cryptogram 508, and as such, as associatedwith client device 102 or executed wallet application 104. Asillustrated in FIG. 5B, executed verification engine 330 may obtain,from data records 542, a local code challenge 544 (e.g., generated usingany of the exemplary processes described herein), and perform operationsthat determine whether code challenge 522 (e.g., as received from clientdevice 102) is consistent with, and corresponds to, local code challenge544.

As described herein, code challenge 522 may also be associated with anadditional digital signature applied to code challenge 522 by executedwallet application 104 using private cryptographic key 520. In someinstances, not illustrated in FIG. 5B, executed verification engine 330may perform any of the exemplary processes described herein to validatethe additional digital signature applied to code challenge 522 prior todetermining the consistency and correspondence between code challenge522 and local code challenge 544.

If, for example, executed verification engine 330 were to detect aninconsistency between code challenge 522 and local code challenge 544(and in some instances, were unable to validate the additional digitalsignature applied to code challenge 522), executed verification engine330 may decline the requested allocation, and may discard allocationrequest 524. In some instances (not illustrated in FIG. 5B), executedverification engine 330 may perform any of the exemplary processesdescribed herein to generate and transmit a corresponding error messageacross network 120 to client device 102, e.g., for presentation within adisplay screen of referral interface 220. Alternatively, based on thevalidation of first digital signature 526 and second digital signature540 (and in some instances, the validation of the additional digitalsignature applied to code challenge 522), and based on the determinedconsistency between code challenge 522 and local code challenge 544,executed verification engine 330 may approve the requested allocation,e.g., based on the prior approval of, and consent to, the requestedallocation registration by user 101 and wallet system 130, as indicatedby respective ones of now-validated first and second digital signatures526 and 540.

As illustrated in FIG. 5B, executed verification engine 330 may provideapproved allocation request 524 as an input to a distributed allocationengine 546 executed by the one or more processors of gateway system 160.In some examples, executed distributed allocation engine 546 may performany of the exemplary processes described herein to determine that therequested allocation complies within one or more allocation rulesassociated with the referral campaign (e.g., as maintained by gatewaysystem 160 within campaign data store 166), and based on thedetermination that the requested allocation complies with the one ormore allocation rules, and generate an allocation object indicative ofthe allocation of the redeemable and transferrable digital asset, or thepredetermined quantity of that digital asset, to user 101 in response tothe successful referral of user 121 for membership in the loyaltyprogram (e.g., that associates public cryptographic key 518 with assetdata identifying and characterizing the allocated digital asset, or thequantity of allocated digital assets).

Executed distributed allocation engine 546 may access campaign datastore 166 (and/or rules database 168), and obtain allocation data 548that, among other things, identify the digital asset, or thepredetermined quantity of that digital asset, subject to allocation touser 101 in response to the successful referral of user 121 formembership in the loyalty program (e.g., ten units of the redeemable andtransferrable digital coin), and identify and characterize one or moreallocation rules that impose corresponding conditions on the allocationof the digital asset, or the predetermined quantity of the digitalasset, to user 101 in response to the successful referral. Examples ofthese imposed conditions may include, but are not limited to, arequirement that user 121 represent a newly registered member of theloyalty program, and as such, that the elements of updated distributedledger 356 record a single registration object associated with executedwallet application 124 (e.g., registration object 338 that includespublic cryptographic key 272), or a requirement that the elements ofupdated distributed ledger 356 record a single registration object thatincludes data characterizing user 121, client device 122, or executedwallet application 124 (e.g., registration object 338 that includesregistration data 304, which specifies device identifier 254,application cryptogram 256, and/or customer profile data 253).

In some examples, and to establish a compliance between the requestedallocation and the conditions imposed on the requested allocation by theone or more allocation rules of allocation data 548. For instance,executed distributed allocation engine 546 may access confirmationmessage 362 maintained within allocation request 524, and may obtainpublic cryptographic key 272 of executed wallet application 124 (e.g.,as associated with referred user 121 of client device 122) andidentifier 352A, which identifies the particular element of updateddistributed ledger 356 that maintains registration object 338 associatedwith user 121 and executed wallet application 124. Executed distributedallocation engine 546 may also access updated distributed ledger 356, asmaintained the one or more tangible, non-transitory memories of gatewaysystem 160, and may parse the elements of updated distributed ledger 356to identify one or more of the elements recording a registration objectthat includes, or references, public cryptographic key 272.

As illustrated in FIG. 5B, executed distributed allocation engine 546may establish that updated distributed ledger 356 includes only a singleelement, e.g., element 352, that includes a registration objectreferences public cryptographic key 272, e.g., registration object 338.As such, executed distributed allocation engine 546 may establish thatthe requested allocation complies with a first one of the conditionsimposed by the allocation rules of allocation data 548, e.g., thatupdated distributed ledger 356 record a single registration objectassociated with executed wallet application 124. In other instances,executed distributed allocation engine 546 may also perform operationsthat access registration object 338, and obtain device identifier 254(e.g., which identifies client device 122), application cryptogram 256(e.g., which identifies executed wallet application 124), and/orcustomer profile data 253 (e.g., which identifies and characterizedsuccessfully referred user 121).

In further instances, executed distributed allocation engine 546 mayparse the elements of updated distributed ledger 356 to identify apresence of any additional, or alternate elements (e.g., other thanelement 352) that include registration objects referencing deviceidentifier 254, application cryptogram 256, or any portion of customerprofile data 253. For example, if executed distributed allocation engine546 were to establish that element 352 represents the only element ofupdated distributed ledger 356 having a registration object thatreferences device identifier 254, application cryptogram 256, or anyportion of customer profile data 253, executed distributed allocationengine 546 may establish that the requested allocation complies with asecond first one of the conditions imposed by the allocation rules ofallocation data 548, e.g., that the elements of updated distributedledger 356 record a single registration object that includes datacharacterizing user 121, client device 122, or executed walletapplication 124. The disclosed embodiments are, however, not limited tothese exemplary imposed conditions or these exemplary allocation rules,and in other examples, allocation data 548 may identify any additionalor alternate allocation rule that imposes any additional or alternate oralternate condition on the requested allocation of the digital asset, orthe predetermined quantity of the digital asset, to user 101 in responseto the successful referral of user 121 for membership in the loyaltyprogram.

In other examples, not illustrated in FIG. 5B, gateway system 160 maybroadcast public cryptographic key 272 of executed wallet application124 and/or element identifier 352A across network 120 to one or more ofnode systems 180, including node system 182. Each of the one or more ofnode systems 180, including node system 182, may access and executeelements of code recorded within the elements of distributed ledger 356(e.g., within smart contract elements 192), which collectively establisha distributed smart contract that determines the consistency between theconditions imposed by the one or more allocation rules and requestedallocation of the digital asset, or the predetermined quantity of thedigital asset to user 101 in response to the successful referral. Forexample, all or a selected portion of allocation data 548, whichidentifies and characterizes the one or more allocation rules, may beimmutably recorded within smart contract elements 192 of distributedledger 356.

Referring back to FIG. 5B, if executed distributed allocation engine 546may establish an inconsistency between at least one of the conditionsimposed by the allocation rules and requested allocation of the digitalasset, executed distributed allocation engine 546 may decline therequested allocation and may generate an error message, which gatewaysystem 160 may transmit across network 120 to client device 102 viawallet system 130, e.g., for presentation within a display screen ofreferral interface 220. Alternatively, if executed distributedallocation engine 546 were to establish a consistency between theconditions imposed by the allocation rules and the requested allocationof the digital asset, executed distributed allocation engine 546, mayalso apply one or more fraud detection and mitigation processes to theallocation request (not illustrated in FIG. 5B). By way of example, theapplied fraud detection and mitigation processes may include adding datacharacterizing the allocation request to a queue of pending requests,which may delay processing that allocates the digital asset, or thepredetermined quantity of the digital asset, to user 101 predeterminedor dynamically determined time period. In some instances, and uponexpiration of the predetermined or dynamically determined time period,executed distributed allocation engine 546 may establish a successfuloutcome of the fraud detection and mitigation processes, and may performfurther operations that complete the allocation of the digital asset, orthe predetermined quantity of the digital asset, to user 101 in responseto the successful referral of user 121 for membership in the loyaltyprogram.

Referring back to FIG. 5B, executed distributed allocation engine 546may perform operations that obtain, from allocation data 548, creditdata 550 that identifies the digital asset, or the predeterminedquantity of the digital asset, available for allocation to user 101 inresponse to the successful referral of user 121 for membership in theloyalty program, e.g., the ten units of the redeemable or transferrabledigital coins. In some examples, executed distributed allocation engine546 may package public cryptographic key 518 of executed walletapplication 104 and credit data 550 into corresponding portions of anallocation object 552 associated with user 101 and executed walletapplication 104, and may also apply a digital signature 554 toallocation object 552 using private cryptographic key 342 of gatewaysystem 160, e.g., as maintained within cryptographic data store 164.

In some instances, executed distributed allocation engine 546 mayperform additional operations that cause gateway system 160 to broadcastallocation object 552, digital signature 554, and public key certificate344 of gateway system 160 (that includes public cryptographic key 346 ofgateway system 160) across network 120 to one or more of node systems180, such as node system 182, which may perform any of the exemplaryprocesses described herein to record allocation object 552 within one ormore elements of a distributed ledger, such as an latest, longestversion of distributed ledger 356. As described herein, upon recordationof allocation object 552 within the one or more elements of thedistributed ledger, the digital asset, or the predetermined quantity ofthe digital asset (e.g., as specified within credit data 550) may beallocated to user 101, and may credit a current balance of the digitalasset held by user 101 and available for redemption or for transfer toother members of the loyalty program or to members of additional loyaltyprogram, e.g., using any of the exemplary redemption or transferprocesses implemented collectively by executed wallet application 104(or executed wallet application 124), wallet system 130, and gatewaysystem 160.

For example, and as illustrated in FIG. 5B, a programmatic interfaceestablished and maintained by each of node systems 180, such as API 348of node system 182, may receive allocation object 552, digital signature554, and public key certificate 344 from gateway system 160, and mayroute allocation object 552, digital signature 554, and public keycertificate 344 to a corresponding block generation engine, such asblock generation engine 350 of node system 182. When executed by the oneor more processors of node system 182 (and each additional or alternateone of node systems 180), block generation engine 350 may performoperations that verify digital signature 554 using public cryptographickey 346 (e.g., as obtained from public key certificate 344), thatgenerate an additional element 556 of distributed ledger 356 that, amongother things, includes allocation object 552, e.g., public cryptographickey 518 of executed wallet application 104 and credit data 550, whichidentifies the digital asset, or the predetermined quantity of thedigital asset, subject to allocation to user 101.

In some instances, executed block generation engine 350 (and the blockgeneration engine executed by additional ones of node systems 180) mayperform operations that generate and apply a digital signature 558 toallocation object 552 (e.g., using a corresponding private cryptographickey of node system 182), and that generate a hash value 560 based on anapplication of one or more appropriate hash algorithms to allocationobject 552 and digital signature 558 (and in some instances, to otherelements of distributed ledger 356). Executed block generation engine350 may package digital signature 558 and hash value 560 intocorresponding portions of additional element 556, e.g., in conjunctionwith allocation object 552.

Further, node system 182 (and each additional or alternate one of nodesystems 180) may perform additional operations that append additionalelement 556 to a prior version of the permissioned distributed ledger(e.g., distributed ledger 356) to generate a latest, longest version ofthe permissioned distributed ledger, e.g., an updated distributed ledger564. In some instances, node system 182 (and each additional oralternate one of node systems 180), may also generate and assign anidentifier 556A to the additional element, such as a positionalidentifier (e.g., a “block number”) that specifies a sequential positionof additional element 556 in relation to the existing, prior elements ofthe distributed ledger. These additional operations may, for example, beestablished through a distributed consensus among additional ones ofnode systems 180, and may include, but are not limited to, thecalculation of an appropriate proof-of-work or proof-of-stake bydistributed consensus module 358 prior to the other peer systems. Incertain aspects, node system 182 may broadcast evidence of thecalculated proof-of-work or proof-of-stake to additional ones of nodesystems 180 across network 120 (e.g., as consensus data 566).

Node system 182 may also broadcast updated distributed ledger 564, whichrepresents the latest, longest version of the distributed ledger, to theadditional ones of node systems 180 operating within environment 100 andadditionally or alternatively, to each of the network-connected systemsthat participate in the permissioned, distributed-ledger networkdescribed herein, such as gateway system 160. In some instances, notillustrated in FIG. 3B, executed distributed allocation engine 546 ofgateway system 160 may store updated distributed ledger 564 within aportion of the one or more tangible, non-transitory memories, such asdata repository 161 (e.g., to replace distributed ledger 190), and maygenerate a confirmation message 568 that confirms the allocation of thedigital asset, or the predetermined quantity of the digital asset, touser 101 in response to the successful referral of user 121 formembership in the loyalty program, and the availability of theseallocated digital asserts for redemption or transfer using any of theexemplary processes described herein.

Executed distributed allocation engine 546 may perform operations thatcause gateway system 160 to transmit confirmation message 568 acrossnetwork 120 to client device 102, e.g., for presentation within acorresponding display screen of referral interface 220. A secure,programmatic interface established and maintained by client device 102,such as API 214, may receive confirmation message 568, and may routeconfirmation message 568 to executed wallet application 104, which mayprocess confirmation message 568 and generate one or more interfaceelements 570 that, when rendered for presentation by display unit 218,collectively establish an additional display screen 572 of referralinterface 220 (not illustrated in FIG. 5B).

In some examples, the referral campaign established by and operatingwithin the loyalty program of the financial institution may allocate adigital asset, or a predetermined quantity of the digital asset (e.g.,the ten units of the redeemable and transferrable digital coinsdescribed herein) to an existing customer to a successful referral of anadditional customer of the financial institution for membership in theloyalty program, and further, to the additional customer upon successfulregistration as a member of the loyalty program. As described herein,certain of these digital assets, e.g., as allocated to the members ofthe loyalty program through participation in the exemplary qualifyingtransactions or the referral campaigns described herein, or receivedthrough the exemplary peer-to-peer (P2P) transfers described herein, maybe redeemed for one or more physical or digital products offered by thefinancial institution that established and manages the loyalty program.

By way of example, these physical or digital products may include, butare not limited to, one or more physical or virtual stored-value or“gift” cards loaded with predetermined amounts of a fiat currency andexchangeable for corresponding, predetermined quantities of theallocated digital assets (e.g., the digital coins described herein). Inother instances, certain of these allocated digital assets may beredeemed, and converted into, a credit against an outstanding balanceassociated with one or more payment instruments issued by the financialinstitution and held by one or more of the existing members or the newlyregistered customers. The disclosed embodiments are, however, notlimited to these exemplary physical or digital products, and in otherinstances, the existing member or the newly registered customer mayredeem certain quantities of the allocated digital assets for anyadditional or alternate physical or digital product available to andoffered by the financial institution associated with the loyaltyprogram.

Referring to FIG. 6A, a redemption engine 602 executed by the one ormore processors of program system 140 may access member database 142,and may further access one or more structured or unstructured datarecords 204, which identify and characterize a current member of theloyalty program, such as user 101. As described herein, data record 204may include information that identifies user 101, the device operated byor associated with user 101 (e.g., the IP or MAC address of clientdevice 102), along with additional elements of contact information andprofile data that identify and characterize user 101. In some instances,executed redemption engine 602 may extract, from data record 204, a useridentifier 206 of user 101 and a device identifier 208 of client device102 (e.g., IP address).

Further, executed redemption engine 602 may also perform operations thataccess redemption data store 146, and obtain one or more elements 606 ofthe redemption data that identify and characterize the physical orvirtual products available for redemption by user 101 usingpredetermined quantities of digital assets allocated to user 101,through participation in the exemplary qualifying transactions or thereferral campaigns described herein, or received through the exemplarypeer-to-peer (P2P) transfers described herein. By way of example,redemption data elements 604 may specify that user 101 may redeem afirst quantity of digital assets (e.g., fifteen units of the digitalcoin) in exchange for a physical stored-value card loaded within CA$25.00, a second quantity of the digital assets (e.g., thirty units ofthe digital coin) in exchange for a virtual stored-value card loadedwithin CA $60.00, and a third quantity of digital assets (e.g., fiftyunits of the digital coin) in exchange for a credit of CA $75.00 againstan statement of a credit card account issued by the financialinstitution and held by user 101. Executed redemption engine 602 maypackage user identifier 206 and all, or a selected portion, ofredemption data elements 606, into corresponding portions ofnotification data 608, which program system 140 may transmit acrossnetwork 120 to client device 102, e.g., using the IP address specifiedwithin device identifier 208.

A programmatic interface associated with wallet application 104, such asAPI 214, may receive notification data 608 from program system 140, andmay provide notification data 608 as an input to wallet application 104,e.g., as executed by the or more processors of client device 102.Executed wallet application 104 may perform operations that storenotification data 608 within a portion of the tangible, non-transitorymemories of client device 102, e.g., for subsequent processing duringone or more of the exemplary asset redemption operations describedherein (not illustrated in FIG. 6A). In some instances, executed walletapplication 104 may process notification data 608 (e.g., that includesuser identifier 206 and redemption data elements 606), and may generateone or more interface elements 609 that, when rendered for presentationby display unit 218, collectively establish a display screen of aredemption interface 612. For example, as illustrated in FIG. 6A, thedisplay screen of redemption interface 610 may include interfaceelements 610A, which identity and offer user 101 an opportunity toredeem allocated and accrue digital assets (e.g., digital coins) foravailable physical or digital products of services (e.g., “Hi John! Youcan redeem digital coins for the following”).

The display screen of redemption interface 610 may also include: (i)interface element 610B, which identifies the available physicalstored-value card loaded within CA $25.00 and redeemable for fifteenunits of the digital coin, and an interactive interface element, e.g.,check box 610C, that allows user 101 to select the physical stored-valuecard for redemption; (ii) interface element 610D, which identifies theavailable virtual stored-value card loaded within CA $60.00 andredeemable for thirty units of the digital coin, and an interactiveinterface element, e.g., check box 610E, that allows user 101 to selectthe virtual stored-value card for redemption; and (iii) interfaceelement 610F, which identifies the available statement credit in theamount of CA $75.00 and redeemable for fifty units of the digital coin,and an interactive interface element, e.g., check box 610G, that allowsuser 101 to select the available statement credit for redemption.Additionally, the display screen of redemption interface 610 may alsoinclude an additional interactive interface element, e.g., “SUBMIT” icon610H, which upon selection by user 101, causes executed walletapplication 104 to perform operations that initiate one or more of theexemplary processes described herein to redeem the selected physical orvirtual product for the corresponding units of the allocated and accrueddigital asset, e.g., based on data exchanged with, and validated by,wallet system 130 and gateway system 160.

For example, and upon viewing the display screen of redemption interface612, user 101 may elect to redeem the fifteen units of the digital coinfor the available physical stored-value card loaded within CA $25.00. Insome instances, user 101 may provide, via input unit 222 of clientdevice 102, input 224 that selects check box 610C (e.g., by “checking”check box 610C) to indicate an intention to redeem the fifteen units ofthe digital coin for the available physical stored-value card loadedwithin CA $25.00, and that then selects “SUBMIT” icon 610H. Further,although not illustrated in FIG. 6A the selection of SUBMIT″ icon 610Gmay cause display unit 240 to present interface elements that establishone or more additional display screens of redemption interface 612, andthat prompt user 101 to provide further input specifying one or moreauthentication credentials of user 101, such as, but not limited to, analphanumeric login credential, an alphanumeric password, or a biometriccredential (e.g., a thumbprint image, a facial image, etc.). In someinstances, the provisioning of the one or more authenticationcredentials in response to the selection of “SUBMIT” icon 610H mayfurther confirm the intention of user 101 to redeem the fifteen units ofthe digital coin for the available physical stored-value card loadedwithin CA $25.00. Input unit 222 may receive input 614 (e.g., thatspecifies the selection of check box 610C, the selection of “SUBMIT”icon 610H, and in some instances, the one or more authenticationcredentials) and may route input data 616 representative of the receivedinput to executed wallet application 104.

Referring to FIG. 6B, a redemption module 618 of executed walletapplication 104 may receive input data 616, and may parse input data 616to detect the requested redemption of the fifteen units of the digitalcoin by user 101, and to extract authentication data 620 representativeof the provisioned authentication credentials, which redemption module618 may store within a portion of credential data store 106, e.g., inassociation with device identifier 506 (e.g., the IP address of clientdevice 102), application cryptogram 508 (e.g., that uniquely identifiesexecuted wallet application 104), and customer profile data 510 (e.g.,the identifies and characterizes user 101). Further, redemption module618 may further process input data 616 and corresponding portions ofredemption data elements 606 (e.g., as maintained locally withinnotification data 608) to generate parameter data 622 that characterizesthe requested redemption. By way of example, parameter data 622 mayinclude one or more identifiers of the selected physical or virtualproduct (e.g., an alphanumeric identifier assigned to the selectedphysical stored-value card by program system 140) and data thatidentifies the quantity of the digital asset subject to redemption(e.g., the fifteen units of the digital coin). As illustrated in FIG.6B, redemption module 618 may also store redemption parameter data 622within a corresponding portion of credential data store, e.g., inconjunction with authentication data 620, device identifier 506,application cryptogram 508, and customer profile data 510.

In some instances, and prior to initiating one or more of the exemplaryredemption processes described herein (e.g., through a generation andtransmission of a corresponding redemption request to wallet system130), executed wallet application 104 may perform additional operationsthat, in conjunction with gateway system 160, determine a currentbalance of digital assets held by user 101 and available for redemptionfor the physical or virtual products. For example, the elements ofdistributed ledger 564 (and any of the additional or alternate of theexemplary distributed ledgers described herein, such as distributedledger 190 and 356) may record information that, in conjunction withpublic cryptographic key 518 of executed wallet application 104,identifies and tracks each unit of the digital asset allocated to user101 through participation in the exemplary qualifying transactions orthe referral campaigns described herein, redeemed by user 101 throughany of the exemplary redemption processes described herein, or receivedor transferred through the exemplary peer-to-peer (P2P) transfersdescribed herein. Further, the elements of distributed ledger 564 mayalso record elements of code (e.g., within one or more smart contractelements 192) that, when executed by one or more of node systems 180 inresponse to instructions received from gateway system 160, cause nodesystems 180 to perform consensus-based operations that query theelements of distributed ledger 564 and establish the current balance ofdigital assets associated with public cryptographic key 518 and as such,available to user 101 for transfer or redemption.

As illustrated in FIG. 6B, redemption module 618 may perform operationsthat obtain device identifier 506 from credential data store 106, andthat obtain public cryptographic key 518 of executed wallet application104 from cryptographic data store 108. In some instances, redemptionmodule 618 may package device identifier 506 and public cryptographickey 518 into corresponding portions of a balance query 624, which clientdevice 102 may transmit across network 120 to gateway system 160. Insome instances, balance query 624 may be generated, and transmitted togateway system 160, without one or more of the challenge codes generatedby gateway system 160, e.g., using any of the processes describedherein.

A secure, programmatic interface of gateway system 160, such asapplication programming interface (API) 623, may receive balance query624, and may provide balance query 624 as an input to a distributedquery engine 626 of gateway system 160. Upon execution by the one ormore processors of gateway system 160, distributed query engine 626 mayperform operations that store balance query 624, which includes publiccryptographic key 518 and device identifier 506, within a portion of theone or more tangible, non-transitory of gateway system 160, e.g., withina portion of data repository 161 (not illustrated in FIG. 6B). Further,executed distributed query engine 626 may extract public cryptographickey 518 from balance query 624, and may package public cryptographic key518 and a query identifier 630 into corresponding portions of adistributed query 632, which gateway system 160 may broadcast acrossnetwork 120 to one or more of node systems 180, including node system182.

In some instances, a secure programmatic interface of the one or more ofnode systems 180, such as API 348 of node system 182, may receivedistributed query 632 from gateway system 160, and may route distributedquery 632 to a corresponding query management engine, such as querymanagement engine 634 of node system 182. When executed by the one ormore processors of node system 182 (and each additional or alternate oneof node systems 180), query management engine 634 may processdistributed query 632, detect query identifier 630 (e.g., thatidentifies the requested balance inquiry associated with publiccryptographic key 518), and based on the detection of query identifier630, perform operations that trigger an execution of the one or moreelements of code recorded within smart contract element 192 ofdistributed ledger 564 (e.g., a balance inquiry module 636). Forexample, and upon execution by the one or more processors of node system182 (and by each additional or alternate one of node systems 180),balance inquiry module 636 may receive distributed query 632, accesspublic cryptographic key 518 of executed wallet application 104, andparse the elements of distributed ledger 564 to identify each elementthat includes or references public cryptographic key 518, such as, butnot limited to, element 556 that records allocation object 552, asdescribed herein.

As described herein, each identified element of distributed ledger 564that includes or references public cryptographic key 518 may recordinformation (e.g., a data object) associated with a registrationoperation or a key-regeneration operation involving user 101 or executedwallet application 104, or with an allocation, redemption, or transferoperation that credits a quantity of the digital asset (e.g., thedigital coin) to, or that debits a quantity of the digital asset from,user 101 or executed wallet application 104. In some instances, executedbalance inquiry module 636 may perform operations that parse theidentified elements of distributed ledger 564 (e.g., that include orreference public cryptographic key 518) and obtain correspondingelements of asset credit or asset debit data, and based on the elementsof asset credit or asset debit data, compute a current balance 638 ofdigital assets associated with public cryptographic key 518 andavailable to user 101. As illustrated in FIG. 6B, executed balanceinquiry module 636 may return current balance 638 to executed querymanagement engine 634 of node system 182, which may package currentbalance 638 into a corresponding portion of response data 640. Uponsuccessful completion of any of the exemplary consensus-based processesdescribed herein, node system 182 may transmit response data 640 acrossnetwork 120 to gateway system 160 (e.g., via API 623), and executeddistributed query engine 626 may perform operations that cause gatewaysystem 160 to route response data 640 back to client device 102 acrossnetwork 120 (not illustrated in FIG. 6B).

Referring to FIG. 7A, a programmatic interface established andmaintained by client device 102, such as API 502 of executed walletapplication 104, may receive response data 640 and may route responsedata 640 to redemption module 618 of executed wallet application 104. Insome instances, redemption module 618 may perform operations that obtaincurrent balance 638 of the available digital assets from response data640, and based on portions of redemption parameter data 622, determinewhether current balance 638 of the available digital assets isequivalent to, or exceeds, the quantity of the digital asset subject toredemption (e.g., the fifteen digital coins). If, for example,redemption module 618 were to determine that the available balance ofthe digital assets is insufficient to support the requested redemption(e.g., that the quantity of the digital asset subject to redemptionexceeds the current balance), redemption module 618 may decline toinitiate the requested redemption, and executed wallet application 104may perform operations that generate and present an error message withinan additional display screen of redemption interface 612. Alternatively,if redemption module 618 were to determine that the available balance ofthe digital assets is sufficient to support the requested redemption(e.g., that the current balance of the digital asset exceeds thequantity of the digital asset subject to redemption), redemption module618 may perform additional operations that, in conjunction with walletsystem 130, gateway system 160, and program system 140, initiate aredemption of the selected physical product (e.g., the stored-value cardloaded with CA $25) for the corresponding quantity of the digital asset(e.g., the fifteen digital coins).

Redemption module 618 may also perform operations that generate arequest 702 to redeem the specified quantity of the digital asset (e.g.,the fifteen units of the digital coin) for the selected physical product(e.g., the stored-value card loaded with CA $25). For example,redemption module 618 may generate redemption request 702 based on, andresponsive to, the determination that the available balance of thedigital assets held by user 101 is sufficient to support the requestedredemption, and further, redemption module 618 may generate redemptionrequest 702 automatically and without further input by user 101. In someinstances, redemption module 618 may package, into correspondingportions of redemption request 702, one of more of: (i) publiccryptographic key 518, which uniquely identifies user 101 and executedwallet application 104); (ii) redemption parameter data 622, whichincludes the one or more identifiers of the selected physical product(e.g., an alphanumeric identifier assigned to the selected physicalstored-value card by program system 140) and data that identifies thequantity of the digital asset subject to redemption (e.g., the fifteenunits of the digital coin); and (iii) one or more of device identifier506 or application cryptogram 508.

Further, although not illustrated in FIG. 7A, redemption module 618 mayperform any of the exemplary processes described herein to request, andreceive, a digital token 704 from wallet system 130 (e.g., in responseto a successful authentication process between executed walletapplication 104 and one or more application programs, engines, ormodules executed by the one or more processors of wallet system 130),and to request, and receive, a code challenge 706 from gateway system160. In some instances, redemption module 618 may store digital token704 and code challenge 706 within a portion of credential data store 106associated with authentication data 620, device identifier 506,application cryptogram 508, and customer profile data 510. As describedherein, digital token 704 may correspond to a one-time-use (OTU) tokenvalid to authenticate the identity of user 101 during a singledigital-asset redemption process, and may be characterized by apredetermined composition, length, or format. Further, code challenge706 may be generated by gateway system 160 using any of the exemplaryprocesses described herein, and correspond to a hash valuerepresentative of all or a selected portion of device identifier 506and/or application cryptogram 508, or may correspond to a hash valuerepresentative of a plaintext cipher maintained confidentially bygateway system 160.

Redemption module 618 may also package digital token 704 and codechallenge 706 into corresponding portions of redemption request 702,e.g., in addition to public cryptographic key 518, redemption parameterdata 622, device identifier 506, and/or application cryptogram 508.Further, although not illustrated in FIG. 7A, redemption module 618 mayalso apply a digital signature to code challenge 706 prior to packagingcode challenge 706 into a corresponding portion of redemption request702. Redemption module 618 of executed wallet application 104 may alsoperform operations that apply a first digital signature 708 toredemption request 702 using private cryptographic key 520 of executedwallet application 104, as maintained securely within cryptographic datastore 108. In some examples, the application of first digital signature708 to redemption request 702 may be indicative of an approval of, and aconsent to, the requested redemption of the specified quantity of thedigital asset (e.g., the fifteen digital coins) for the selectedphysical product (e.g., the stored-value card loaded with CA $25).Further, certain of the exemplary process described herein, which couplethe application of first digital signature 708 to redemption request 702to a level or type of consent granted by user 101 to wallet system 130and/or gateway system 160 to access or manipulate confidentialregistration, allocation, or redemption data, may be implemented inaddition to, or as an alternate to, existing token-based authorizationand consent protocols (e.g., an OAuth protocol, etc.) during theasset-allocation processes implemented collectively by client device102, wallet system 130, and gateway system 160.

Redemption module 618 may also perform operations that cause clientdevice 102 to transmit redemption request 702, first digital signature708, and in some instances, public key certificate 528 of client device102 (which includes public cryptographic key 518) across network 120 towallet system 130. As illustrated in FIG. 7A, a secure, programmaticinterface established and maintained by wallet system 130, such as API310, may receive redemption request 702, first digital signature 708,and in some instances, public key certificate 528, and may trigger anexecution of a redemption engine 710 by the one or more processors ofwallet system 130.

For example, a verification module 712 of executed redemption engine 710may receive redemption request 702, first digital signature 708, andpublic key certificate 528 from API 310. In some instances, verificationmodule 712 may parse public key certificate 528 and obtain a publiccryptographic key associated client device 102 (e.g., publiccryptographic key 518 of executed wallet application 104), and performoperations that verify first digital signature 708 based on the obtainedpublic cryptographic key. If, for example, verification module 712 wereunable to verify first digital signature 708, verification module 712may establish that redemption request 702 was either corrupted duringtransmission of altered one or more third parties without permission,and executed redemption engine 710 may decline the requested redemption.In some instances (not illustrated in FIG. 7A), executed redemptionengine 710 may generate and transmit an error message across network 120to client device 102, e.g., for presentation within a correspondingdigital interface, such as a display screen of redemption interface 612.

Alternatively, if verification module 712 were to verify first digitalsignature 708, verification module 712 may perform operations thatobtain device identifier 506, application cryptogram 508, and digitaltoken 704 from redemption request 702, and may identify one or more datarecords 714 within credential data store 132 that include or referencedevice identifier 506 or application cryptogram 508, and as such, areassociated with client device 102 or executed wallet application 104. Asillustrated in FIG. 7A, verification module 712 may obtain, from datarecords 714, a local digital token 716, which is indicative of acurrently valid authentication of the identity of user 101, and performoperations that determine whether digital token 704 (e.g., as receivedfrom client device 102) is consistent with, and corresponds to, localdigital token 716. If, for example, verification module 712 were todetect an inconsistency between digital token 704 and local digitaltoken 716, executed redemption engine 710 may decline the requestedredemption, and may generate and transmit an error message acrossnetwork 120 to client device 102, e.g., for presentation within adisplay screen of redemption interface 612.

Alternatively, based on the verification of first digital signature 708,and based on the determined consistency between digital token 704 andlocal digital token 716, verification module 712 may approve therequested redemption and verify redemption request 702 for furtherprocessing, e.g., by gateway system 160. In some instances, verificationmodule 712 may provide redemption request 702, first digital signature708, and in some instances, public key certificate 528 and as input to aconsent module 718 of executed redemption engine 710. In some instances,consent module 718 may perform operations that apply a second digitalsignature 720 to redemption request 702 (e.g., that includes publiccryptographic key 518, redemption parameter data 622, digital token 704,code challenge 706, device identifier 506 and/or application cryptogram508) and to first digital signature 708. As described herein, theapplication of second digital signature 720 to redemption request 702and to first digital signature 708 may indicative of an approval of, anda consent to, the requested redemption of the specified quantity of thedigital asset (e.g., the fifteen digital coins) for the specifiedphysical product (e.g., the stored-value card loaded with CA $25) bywallet system 130. Executed redemption engine 710 may perform operationsthat cause wallet system 130 to transmit redemption request 702, firstdigital signature 708, second digital signature 720, public keycertificate 528 of client device 102 (e.g., that includes publiccryptographic key 518) and public key certificate 326 (e.g., thatincludes public cryptographic key 320 of wallet system 130) acrossnetwork 120 to gateway system 160.

Referring to FIG. 7B, a programmatic interface establish and maintainedby gateway system 160, such as API 328, may receive redemption request702, first digital signature 708, second digital signature 720, publickey certificate 528, and public key certificate 326, and may performoperations that trigger an execution of verification engine 330 by theone or more processors of gateway system 160 (e.g., based on one or moreprogrammatically generated commands). In some instances, executedverification engine 330 may parse public key certificate 528 to extractpublic cryptographic key 518 of executed wallet application 104, and mayparse public key certificate 326 to extract public cryptographic key 320of wallet system 130. Executed verification engine 330 may performoperations that validate second digital signature 720 (e.g., as appliedto redemption request 702 and first digital signature 708) using publiccryptographic key 320 of wallet system 130 and further, that validatefirst digital signature 708 (e.g., as applied to redemption request 702)using public cryptographic key 518 of executed wallet application 104.

If, for example, executed verification engine 330 were unable to verifyfirst digital signature 708, and additionally, or alternatively, seconddigital signature 720, executed verification engine 330 may decline therequested allocation, and may discard redemption request 702. In someinstances (not illustrated in FIG. 7B), executed verification engine 330may generate an error message indicative of the failed verification offirst digital signature 708 and/or second digital signature 720, andgateway system 160 may transmit the generated error message acrossnetwork 120 to client device 102, e.g., for presentation withinredemption interface 612.

Alternatively, if executed verification engine 330 were to verify firstdigital signature 708 and second digital signature 720, executedverification engine 330 may perform operations that obtain, fromredemption request 702, code challenge 706, device identifier 506,and/or application cryptogram 508. In some examples, executedverification engine 330 may access credential data store 162, andidentify one or more of data records 722 that include or referencedevice identifier 506 or application cryptogram 508, and as such, asassociated with client device 102 or executed wallet application 104. Asillustrated in FIG. 7B, executed verification engine 330 may obtain,from the one or more of data records 542, a local code challenge 544(e.g., generated using any of the exemplary processes described herein),and perform operations that determine whether code challenge 706 (e.g.,as received from client device 102) is consistent with, and correspondsto, local code challenge 724.

As described herein, code challenge 706 may also be associated with anadditional digital signature applied to code challenge 706 by executedwallet application 124 using private cryptographic key 520. In someinstances, not illustrated in FIG. 7B, executed verification engine 330may perform any of the exemplary processes described herein to validatethe additional digital signature applied to code challenge 706 prior todetermining the consistency and correspondence between code challenge706 and local code challenge 724.

If, for example, executed verification engine 330 were to detect aninconsistency between code challenge 706 and local code challenge 724(and in some instances, were unable to validate the additional digitalsignature applied to code challenge 706), executed verification engine330 may decline the requested allocation, and may discard redemptionrequest 702. In some instances (not illustrated in FIG. 7B), executedverification engine 330 may perform any of the exemplary processesdescribed herein to generate and transmit a corresponding error messageacross network 120 to client device 102, e.g., for presentation within adisplay screen of redemption interface 612. Alternatively, based on thevalidation of first and second digital signatures 708 and 720 (and insome instances, the validation of the additional digital signatureapplied to code challenge 706), and based on the determined consistencybetween code challenge 706 and local code challenge 724, executedverification engine 330 may approve the requested allocation.

As illustrated in FIG. 7B, executed verification engine 330 may provideapproved redemption request 702 as an input to a distributed redemptionengine 725, which may be executed by the one or more processors ofgateway system 160. In some instances, executed distributed redemptionengine 725 may perform operations that obtain, from redemption request702, public cryptographic key 518 of executed wallet application 104 andredemption parameter data 622. As described herein, executed distributedredemption engine 725 may perform operations that store redemptionparameter data 622 within one or more of the tangible, non-transitorymemories of gateway system 160, e.g., within a portion of datarepository 161.

Further, executed distributed redemption engine 725 may extract the datathat identifies the quantity of the digital asset subject to redemption(e.g., the fifteen units of the digital coin) from redemption parameterdata 622, and package the extracted data into corresponding portions ofdebit data 726, which recorded within an additional element ofdistributed ledger 564, effects a final redemption of the quantity ofthe digital assets and debit the identified quantity of the digitalasset from the current balance of the digital asset held by user 101. Asillustrated in FIG. 7B, executed distributed redemption engine 725 maygenerate a redemption object 728 associated with the requested andnow-approved redemption that includes public cryptographic key 518 ofexecuted wallet application 104 and debit data 726, and may also apply adigital signature 730 to redemption object 728 using privatecryptographic key 342 of gateway system 160, e.g., as maintained withincryptographic data store 164. Further, executed distributed redemptionengine 725 may perform additional operations that cause gateway system160 to broadcast redemption object 728, digital signature 730, andpublic key certificate 344 of gateway system 160 (that includes publiccryptographic key 346 of gateway system 160) across network 120 to oneor more of node systems 180, such as node system 182.

In some examples, each of the one or more of node systems 180, includingnode system 182, may receive redemption object 728, digital signature730, and public key certificate 344, e.g., via API of node system 182.Each of the one or more of node systems 180, including node system 182,may perform any of the exemplary, consensus-based operations describedherein to: (i) verify digital signature 730 using public cryptographickey 346 (e.g., as obtained from public key certificate 344); and (ii)generate an additional element 732 of distributed ledger 564 thatincludes, among other things, redemption object 728 (e.g., which itselfincludes public cryptographic key 518 and debit data 726), a digitalsignature 734 applied to redemption object 728 (e.g., using a privatecryptographic key of corresponding ones of node systems 180, includingnode system 182), a hash value 736 representative of redemption object728 and digital signature 734 (and in some instances, to other elementsof distributed ledger 564), and an identifier 732A (e.g., a “blocknumber”) that specifies a sequential position of additional element 732in relation to the existing, prior elements of distributed ledger 564.The one or more of node systems 180, including node system 182, may alsoperform operations that append additional element 732 to distributedledger 564 to generate an updated distributed ledger, e.g., distributedledger 738.

Further, and based on a successful completion of these exemplaryconsensus-based processes (e.g., the calculation of an appropriateproof-of-work or proof-of-stake, as described herein) prior to otherones of node systems 180, node system 182 may broadcast distributedledger 738, which represents the latest, longest version of thedistributed ledger, to the additional ones of node systems 180 operatingwithin environment 100 and additionally or alternatively, to each of thenetwork-connected systems that participate in the permissioned,distributed-ledger network described herein, such as gateway system 160.As described herein, the recordation of redemption object 728 withinelement 732 of distributed ledger 738 may result in a final andirrevocable redemption of the identified quantity of the digital assets(e.g., the fifteen units of the digital coin) and may debit of theidentified quantity of the digital asset from the current balance of thedigital asset held by user 101, as tracked by the elements ofdistributed ledger 738.

Although not illustrated in Gateway system 160 may receive distributedledger 738, and executed distributed redemption engine 725 of gatewaysystem 160 may store distributed ledger 738 within a portion of the oneor more tangible, non-transitory memories, such as data repository 161(e.g., to replace distributed ledger 564). Executed distributedredemption engine 725 may also perform operations that, based on thereceipt of distributed ledger 738 and the recordation of redemptionobject 728 within element 732, generate a confirmation message 740 thatconfirms the redemption of the quantity of the digital asset (e.g., thefifteen units of the digital coin) and the debit of those fifteen unitsof the digital coin from the current balance held by user 101. In someinstances, executed distributed redemption engine 725 may also package,into confirmation message 740, a portion of the redemption parameterdata 622 that identifies the physical product associated with therequested redemption (e.g., the stored-value card loaded with CA $25),and may perform operations that cause gateway system 160 to transmitconfirmation message 740 across network 120 via wallet system 130 and toclient device 102.

Referring to FIG. 7C, a secure, programmatic interface established andmaintained by client device 102, such as API 502, may receiveconfirmation message 740, and may route confirmation message 740 toredemption module 618 of executed wallet application 104, which mayprocess conformation message 740 and generate one or more interfaceelements 742 that, when rendered for presentation by display unit 218,collectively establish an additional display screen 744 of redemptioninterface 612. For example, as illustrated in FIG. 7C, display screen744 may confirm the redemption of the identified quantity of the digitalasset (e.g., the fifteen units of the digital coin) for the selectedphysical product, such as the physical stored-value card loaded with CA$25 (e.g., “Congratulations! You redeemed fifteen digital coins inexchange for a $25 gift card. You will receive the gift card from yourbank within the next seven days.”).

Additionally, and in response to the receipt of confirmation message740, redemption module 618 may obtain redemption parameter data 622 fromcredential data store 132, and may extract, from redemption parameterdata 622, product data 748 that identifies the physical productassociated with the requested redemption (e.g., alphanumeric identifierassigned to the stored-value card loaded with CA $25 by program system140). In some instances, redemption module 618 may package product data748, device identifier 506, and/or application cryptogram 508 intocorresponding portions of a purchase order 750, which wallet system 130may transmit across network 120 to program system 140. For example,program system 140 may receive purchase order 750 through a secure,programmatic interface, such as an application program interface (API)associated with executed redemption engine 602, and executed redemptionengine 602 may perform operations that complete the redemption of thestored-value card loaded with CA $25 and provision the selectedstored-value card to user 101, e.g., via an out-of-band communicationschannel, such as mail or courier delivery.

FIGS. 8A and 8A are flowcharts of exemplary processes for securelyinitiating and managing a distribution of digital assets within acomputing environment using permissioned distributed ledgers, inaccordance with the disclosed embodiments. In some examples, a computingsystem capable of provisioning and supporting wallet applicationsexecuted by computing devices within the computing environment, such aswallet system 130, may perform one or more of the exemplary steps ofprocess 800, as described below in reference to FIG. 8A. Further, acomputing system associated with permissioned, distributed-ledgernetwork operating within the environment, such as gateway system 160,may perform one or more of the exemplary steps of process 850, asdescribed below in reference to FIG. 8B.

Referring to FIG. 8A, wallet system 130 may receive, from a clientdevice (e.g., client device 102 or client device 122 of FIG. 1) acrossnetwork 120, a distribution request involving a digital asset and afirst digital signature applied to the distribution request (e.g., instep 802). As described herein, the distribution request may begenerated by a wallet application executed by the client device (e.g.,executed wallet application 104 or executed wallet application 124), andthe distribution request may include, among other things, a publiccryptographic key that identifies the executed wallet application, adigital token generated by wallet system 130 in response to a successfulauthentication of an identity of a user associated with the clientdevice (e.g., a one-time-user (OTU) token), and a code challengegenerated by gateway system 160.

In some examples, described herein, the distribution request maycorrespond to a request for an allocation of a predetermined digitalasset, or a predetermined quantity of the digital asset, to the user inresponse to a successfully completed referral of an additional user formembership in a loyalty program (e.g., within an ongoing referralcampaign, as described herein), or in response to a successfulregistration of the user as a member of the loyalty program. Theallocation request may, for instance, also include data confirming thesuccessful completion of the referral and additionally, oralternatively, the successful registration of the user as the member ofthe loyalty program (e.g., a portion of confirmation message 362, asdescribed herein). In other examples, also described herein, thedistribution request may correspond to a request to redeem apredetermined digital asset, or a predetermined quantity of the digitalasset, held by the user in exchange for a selected physical or virtualproduct through a redemption campaign implemented by the loyaltyprogram. The redemption request may, for instance, also include data(e.g., redemption parameter data 622) that identifies the selectedphysical or virtual product (e.g., an alphanumeric identifier assignedby program system 140) and data that identifies the quantity of thedigital asset subject to redemption.

Further, as also described herein, the wallet application executed bythe client device may apply the first digital signature to thedistribution request, e.g., using a corresponding private cryptographickey. In some instances, the application of the first digital signatureto the distribution request by the executed wallet application may beindicative of an approval of and consent to the requested distributionregistration (e.g., the requested allocation or the requestedredemption) by the user of the client device.

In some instances, wallet system 130 may perform any of the exemplaryprocesses described herein to validate the applied first digitalsignature (e.g., in step 804). If wallet system 130 were unable toverify the first digital signature, (e.g., step 804; NO), wallet system130 may decline the requested distribution (e.g., the requestedallocation or redemption) of the digital asset, or the predeterminedquantity of the digital asset (e.g., in step 806). Wallet system 130 mayperform any of the exemplary processes described herein to generate andtransmit an error message across network 120 to the client device (e.g.,in step 808). Exemplary process 800 is then complete in step 810.

Alternatively, if wallet system 130 were to verify the first digitalsignature (e.g., step 804; YES), wallet system 130 may parse thedistribution request to extract the digital token (e.g., in step 811)and may perform any of the exemplary processes described herein toverify the extracted digital token is consistent with, and correspondsto, a locally maintained copy of the digital token provisioned to theclient device (e.g., in step 812). If, for example, wallet system 130were to detect an inconsistency between the extracted digital token andthe local copy of the digital token (e.g., step 812; NO), exemplaryprocess 800 may pass back to step 806, and wallet system 130 may declinethe requested distribution of the digital asset, or of the predeterminedquantity of the digital asset.

In other examples, if wallet system 130 were to establish a consistency,and a correspondence, between the extracted digital token and thelocally maintained copy of the digital token (e.g., step 812; YES),wallet system 130 may approve, and consent to, the requesteddistribution (e.g., the requested allocation or the requestedredemption) of the digital asset, or of the predetermined quantity ofthe digital asset (e.g., in step 814). Further, wallet system 130 mayperform any of the exemplary processes described herein to apply asecond digital signature to the distribution request and to the firstdigital signature (e.g., in step 816). As described herein, theapplication of the second digital signature to the distribution requestand to the first digital signature may indicative of an approval of, anda consent to, the requested allocation or redemption of the digitalasset, or the predetermined quantity of the digital asset, by walletsystem 130.

In some instances, wallet system 130 may transmit the distributionrequest, the first digital signature, and the second digital signatureacross network 120 to a computing system associated with, and thatparticipates in, the permissioned, distributed-ledger network describedherein, such as gateway system 160 (e.g., in step 818). Exemplaryprocess 800 is then complete in step 810.

Referring to FIG. 8B, gateway system 160 may receive the distributionrequest, the first digital signature, and the second digital signaturefrom wallet system 130 (e.g., in step 852). In some instances, in step854, gateway system 160 may perform any of the exemplary processesdescribed herein to validate the first and second digital signatures. Ifgateway system 160 were unable to validate the first or second digitalsignatures, (e.g., step 854; NO), gateway system 160 may decline therequested distribution (e.g., the requested allocation, or the requestedredemption) of the digital asset, or of the predetermined quantity ofthat digital asset (e.g., in step 856). Gateway system 160 may performany of the exemplary processes described herein to generate and transmitan error message to the client device via wallet system 130 (e.g., instep 858). Exemplary process 850 is then complete in step 860.

Alternatively, if gateway system 160 were to verify both the first andsecond digital signatures (e.g., step 854; YES), gateway system 160 mayparse the distribution request to extract the code challenge (e.g., instep 861), and may perform any of the exemplary processes describedherein to verify that the extracted code challenge is consistent with,and corresponds to, a locally maintained copy of the code challengeprovisioned to the client device (e.g., in step 862). If, for example,gateway system 160 were to detect an inconsistency between the extractedcode challenge and the local copy of the code challenge (e.g., step 862;NO), exemplary process 850 may pass back to step 856, and gateway system160 may decline the requested distribution, as described herein.

Alternatively, if gateway system 160 were to establish a consistency,and a correspondence, between the extracted code challenge and thelocally maintained copy of the code challenge (e.g., step 862; YES),gateway system 160 may perform any of the exemplary processes describedherein to establish a compliance of the requested distribution with oneor more distribution-specific rules that impose corresponding conditionson the requested distribution of the digital asset, or the predeterminedquantity of the digital asset (e.g., in step 864). In some instances,the distribution-specific rules and the corresponding imposed conditionsmay be established by the loyalty program (e.g., through theimplementation of the corresponding referral or redemption campaignsdescribed herein) or by the financial institution associated with theloyalty program, and a computing system associated with the loyaltyprogram, such as program system 140 of FIG. 1, may provision dataidentifying and characterizing the distribution-specific rules togateway system 160 for storage within on the of the tangible,non-transitory memories, e.g., within campaign data store 166 or rulesdatabase 168 of data repository 161.

As described herein, the distribution request may correspond to arequest to allocate of the digital asset, or a predetermined quantity ofthe digital asset, to the user in response to a successfully completedreferral of an additional user for membership in a loyalty programestablished by a financial institution (e.g., as a portion of a referralcampaign), or in response to a successful registration of the user ofthe client device as a member of the loyalty program. In some instances,in step 864, gateway system 160 may establish a compliance of therequested distribution with one or more distribution-specific rules thatimpose corresponding conditions on the requested distribution. Examplesof these imposed conditions may include, but are not limited to, arequirement that additional referred user represent a newly registeredmember of the loyalty program, and as such, that the elements of theexemplary distributed ledgers described herein (e.g., one or more ofdistributed ledgers 190, 356, 564, or 738) record a single registrationobject associated with a wallet application executed at a deviceassociated with that newly registered member.

In other examples, the conditions imposed by the one or moredistribution-specific rules may require that the elements of theseexemplary distributed ledgers record only a single registration objectthat includes profile data characterizing the newly registered member ora device operable by that newly registered member. The disclosedembodiments are, however, not limited to these exemplarydistribution-specific rules, and in other examples, thedistribution-specific rules may include additional or alternate rulesthat impose conditions on the requested allocation, or on a requestedredemption of the digital asset, or the predetermined quantity of thedigital asset for a selected physical or virtual product offered by theloyalty program, e.g., as specified within a corresponding redemptionrequest.

If, for instance, gateway system 160 were to detect an inconsistencybetween at least one of the conditions imposed by the one or moredistribution-specific rules and requested distribution of the digitalasset (e.g., step 864; NO), exemplary process 850 may pass back to step856, and gateway system 160 may decline the requested distribution,e.g., the requested allocation of the digital asset or the predeterminedquantity of the digital asset, or the requested redemption of thedigital asset of the predetermined quantity of the digital asset for theselected physical or virtual product, as described herein.Alternatively, if gateway system 160 were to establish a consistencybetween the conditions imposed by the one or more distribution-specificrules and requested distribution of the digital asset (e.g., step 864;YES), gateway system 160 may also apply one or more fraud detection andmitigation processes to the distribution request (e.g., in step 866). Byway of example, the applied fraud detection and mitigation processes mayinclude adding data identifying the distribution request to a queue ofpending requests, which may delay a processing of the distributionrequest for predetermined or dynamically determined time period.

For example, and upon expiration of the predetermined or dynamicallydetermined time period, gateway system 160 may establish a successfuloutcome of the fraud detection and mitigation processes, and approve,and consent to, the requested distribution of the digital asset, or ofthe predetermined quantity of that digital asset (e.g., in step 868).Gateway system 160 may also perform any of the exemplary processesdescribed herein to generate a distribution object associated with thenow-approved registration request, and to apply any additional digitalsignature to the registration object (e.g., in step 870). As describedherein, the generated distribution object may, for example, represent anallocation object indicative of the allocation of the digital asset, orthe predetermined quantity of that digital asset, to the user inresponse to the successful referral of the additional user formembership in the loyalty program, or in response to the successfulregistration of the user as a member of the loyalty program.Additionally, or alternatively, the generated distribution object mayrepresent a redemption object that, as described herein, indicates aredemption of the digital asset, or a specified quantity of that digitalasset, for a selected physical or virtual product offered through aredemption campaign of the loyalty program.

Further, gateway system 160 may also perform any of the exemplaryprocesses described herein, in conjunction with one or more node systemsoperating within the computing environment, to record immutably thedistribution object within an element of a cryptographically securedistributed ledger, such as within element 556 of distributed ledger 564of FIG. 5B or within element 732 of distributed ledger 738 of FIG. 7B(e.g., in step 872). In some instances, and as described herein, gatewaysystem 160 may receive a confirmation message indicative of therecordation of the distribution object within the element of thedistributed ledger, and may route the confirmation message back to theclient device via wallet system 130 (e.g., in step 874). Exemplaryprocess 850 is then complete in step 860.

D. Secure Management and Regeneration of Cryptographic Keys within aComputing Environment Using Permissioned Distributed Ledgers

Through an implementation of certain of the exemplary processesdescribed herein, one or more computing systems operating withinenvironment 100, such as gateway system 160 and one or more of nodesystems 180, may perform operations that record a registration objectindicative of a successful registration of a corresponding customer of afinancial institution, e.g., user 121 that operates client device 122,as a member of a loyalty program implemented by that financialinstitution. For example, the registration object (e.g., registrationobject 338 of FIG. 3B) may include a public cryptographic key of awallet application executed at client device 122 (e.g., publiccryptographic key 272 maintained within cryptographic data store 128 ofclient device 122) and additional elements of registration data thatidentify and characterize user 121, client device 122, or executedwallet application 124.

In some instances, and as described herein, public cryptographic key 272may represent a unique cryptographic identifier of user 121, clientdevice 102, and executed wallet application 124 during interactionsassociated with the loyalty program (e.g., through any of the exemplarydigital-asset allocation, redemption, or transfer processes describedherein) and involving other computing devices and systems withinenvironment 100, such as wallet system 130, gateway system 160, or nodesystems 180. Further, and through a generation of a data object thatincludes public cryptographic key 272 and information characterizingeach of the interactions between user 121, client device 102, andexecuted wallet application 124 with the loyalty program, and through arecordation of each of the generated data objects within elements of acryptographically secure, permissioned distributed ledger, certain ofthe exemplary processes described herein may establish an immutable andtime evolving record of these interactions, which may be queried usingpublic cryptographic key 272.

As described herein, executable wallet application 124 (e.g., executedat client device 122) may generate public cryptographic key 272 andcorresponding private cryptographic key 274 in response to a successfuloutcome of an authentication process involving wallet system 130, andmay store public cryptographic key 272 and corresponding privatecryptographic key 274 within a secure portion of the one or moretangible, non-transitory memories of client device 122, e.g., withincredential data store 126. In some examples, an occurrence of one ormore events, e.g., a “regeneration” event, may trigger a performance, byexecuted wallet application 124, of operations that regenerate publiccryptographic key 272 and corresponding private cryptographic key 274and further, that requests recordation onto the permissioned distributedledger of an updated registration object that not only specifies theupdated cryptographic identifier of user 121, client device 102, andexecuted wallet application 124 (e.g., the regenerated publiccryptographic key), but also additional data that characterizes each ofthe previously generated public cryptographic keys that identifying user121, client device 102, and executed wallet application 124 within thepermissioned distributed ledger (e.g., pointers to additional elementsof the distributed ledger that record these previously generated publiccryptographic keys). The immutable recordation of the regenerated publiccryptographic key, in conjunction with the additional data specifyingthe previously generated public cryptographic keys, may establish atemporal evolution in the unique cryptographic identifiers of user 121,client device 102, and executed wallet application 124 and as such, mayestablish a “lineage” of these public cryptographic keys within theloyalty program.

Referring to FIG. 9A, executed wallet application 124 of client device122 may access an asymmetric cryptographic key pair, e.g., publiccryptographic key 272 and private cryptographic key 274, maintainedwithin a secure portion of the one or more tangible, non-transitorymemories of client device 122, such as cryptographic data store 128. Forexample, executed wallet application 124 may generate publiccryptographic key 272 and private cryptographic key 274 in accordancewith any of the exemplary processes described herein, e.g., in responseto a successful authentication of an identity of user 121 in conjunctionwith wallet system 130. Further, in some examples, a triggering module902 of executed wallet application 124 may perform operations thatdetect an occurrence of an event, e.g., a “regeneration” event, thattriggers a regeneration of public cryptographic key 272 and privatecryptographic key 274 and that initiates a registration of theregenerated public key within the loyalty program and a recordation anupdated registration block that includes the regenerated public keywithin one or more elements of the exemplary, cryptographically secureand permissioned distributed ledgers described herein.

For example, each of public cryptographic key 272 and privatecryptographic key 274 may be associated with a corresponding temporalperiod of validity, and upon detection of an expiration of thecorresponding temporal validity period, triggering module 902 mayestablish the occurrence of the regeneration event. In some instances,and based on the established occurrence of the regeneration event,triggering module 902 may generate and provide triggering data 904 to akey regeneration module 906 of executed wallet application 124, whichmay perform any of the exemplary processes described herein toregenerate public cryptographic key 272 and private cryptographic key274, e.g., based on an successful outcome of an authentication processinvolving wallet system 130.

The disclosed embodiments are, however, not limited to regenerationevents associated with the temporal validity of public cryptographic key272 and private cryptographic key 274, and in other examples,regeneration events consistent with the disclosed embodiments mayinclude, but are not limited to, an establishment by executed walletapplication 124 of an additional instance of an mobile wallet at clientdevice 102, or a request, by executed wallet application 124, to recorda registration object associated with that additional instance of themobile wallet onto the exemplary, cryptographically secure andpermissioned distributed ledgers described herein (e.g., permissioneddistributed ledger 738 of FIG. 7B). Examples of these regenerationevents may also include, but are not limited to, a deletion andreinstallation of executed wallet application 124 at client device 102,or a migration of user 121, and executed wallet application 124, toanother network-connected computing device or system. Further, in someinstances, regeneration events consistent with the disclosed embodimentsmay also be associated with, and correspond to, instances of fraudulentactivity involving client device 102, wallet system 130, or gatewaysystem 160, such as, but not limited to, an attempted or a successfulbreach, or an unintentional release of confidential data.

Referring back to FIG. 9A, key regeneration module 906 may receivetriggering data 904, which confirms the detected occurrence of theregeneration event associated with public cryptographic key, and mayperform any of the exemplary processes described herein to obtain, fromuser 121, one or more authentication credentials associated with user101 and executed wallet application 124 or wallet system 130. Examplesof these authentication credentials include, but are not limited to, analphanumeric login credential, an alphanumeric password, or a biometriccredential, such as a facial image or a thumbprint image, and in someinstances (not illustrated in FIG. 9A), key regeneration module 906 mayperform operations that cause client device 122 to present, via displayunit 240, one or more interface elements that establish anauthentication interface prompting user 101 to provide the one or moreauthentication credentials.

By way of example, input unit 244 may receive input 907 from user 121that specifies the one or more authentication credentials, and may routeinput data 908 representative of the received input to key regenerationmodule 906 of executed wallet application 124. Key regeneration module906 may parse input data 908 and extract authentication data 910, whichcorresponds to the provisioned authentication credentials, and may alsoperform operations that store authentication data 910 within credentialdata store 126, e.g., as a replacement to authentication data 252 withina portion credential data store 126 that includes customer profile data253, device identifier 254, and application cryptogram 256.

Further, key regeneration module 906 of executed wallet application 124may also perform any of the exemplary authentication processes describedherein to request, and obtain, a digital token 912 from wallet system130, e.g., in response to a successful authentication process betweenexecuted wallet application 124 and one or more application programs,engines, or modules executed by the one or more processors of walletsystem 130. Executed wallet application 124 may also perform operationsthat store digital token 912 within a portion of the one or moretangible, non-transitory memories of client device 102, e.g., within aportion of credential data store 126 associated with authentication data910, customer profile data 253, device identifier 254, and applicationcryptogram 256. For example, digital token 912 may correspond to aone-time-use (OTU) token valid to authenticate the identity of user 101during a single registration, key-regeneration, ordigital-asset-allocation, -redemption, or -transfer process, and may becharacterized by a predetermined composition, length, or format. Thedisclosed embodiments are, however, not limited to OTU tokens, and inother examples, digital token 912 may be valid to authenticate anidentity of user 101 during a predetermined temporal period, or forprocesses initiated within a predetermined geographic region.

Based on the successful authentication of the identity of user 121 bywallet system 130, and on the receipt of digital token 912, keyregeneration module 906 of executed wallet application 124 may performoperations that regenerate the public cryptographic key 272 andcorresponding private cryptographic key 274 of executed walletapplication 124, and that store the regenerated public and privatecryptographic keys within an additional portion of credential data store126. For example, and as illustrated in FIG. 9A, key generation module906 may generate an asymmetric cryptographic key pair 914, includingpublic cryptographic key 916 and private cryptographic key 918, forexecuted wallet application 104 using one or more of the appropriate keygeneration algorithms described herein, and may store each ofregenerated public and private cryptographic keys 916 and 918 within theadditional portion of credential data store 126, e.g., in additional toexisting public and private cryptographic keys 272 and 274.

Further, key regeneration module 906 of executable wallet application104 may also perform any of the exemplary processes described herein torequest and receive a code challenge 920 from gateway system 160, whichkey regeneration module 906 may store within a portion of credentialdata store 106 associated with authentication data 910, deviceidentifier 254, application cryptogram 256, and digital token 912. Insome instances, code challenge 920 may be generated by gateway system160 using any of the exemplary processes described herein, and maycorrespond to a hash value representative of all or a selected portionof device identifier 254 and/or application cryptogram 256, or maycorrespond to a hash value representative of a plaintext ciphermaintained confidentially by gateway system 160.

In some examples, key regeneration module 906 of executed walletapplication 124 may access credential data store 126, and obtain digitaltoken 912 (e.g., the OTU token described herein), code challenge 920(e.g., as received from gateway system 160), device identifier 254 ofclient device 122, and an identifier of executed wallet application 124,such as application cryptogram 256. Additionally, key regenerationmodule 906 may obtain public cryptographic key 916 from cryptographicdata store 128, and may perform operations that package publiccryptographic key 916, digital token 912, code challenge 920, deviceidentifier 254, and application cryptogram 256 into correspondingportions of an updated registration request 922. In some instances, notillustrated in FIG. 9A, key generation module 906 may also apply adigital signature to code challenge 920 prior to packaging codechallenge 920 into a corresponding portion of updated registrationrequest 922.

Further, key regeneration module 906 of executed wallet application 124may also perform operations that apply a first digital signature 924 toupdated registration request 922. In some instances, key generationmodule 906 may apply first digital signature 924 using existing privatecryptographic key 274 of executed wallet application 124 (e.g., asmaintained securely within cryptographic data store 128), and executedwallet application 124 may perform operations that cause client device122 to transmit updated registration request 922, first digitalsignature 924, and in some instances, existing public key certificate308 of client device 122 (which includes existing public cryptographickey 272) across network 120 to wallet system 130.

In other instances, and resulting from a particular one of theregeneration events detected by triggering module 902, existing publicand private cryptographic keys 272 and 274 of executed walletapplication 124 may be unavailable to key regeneration module 906 (e.g.,due to a migration of user 101 from client device 122 to an additionalcomputing device) or may be compromised due to a detected breach orinstance of other fraudulent activity. Due to the unavailability, or thecomprised nature, of existing private cryptographic key 274, keyregeneration module 906 may perform additional operations that applyfirst digital signature 924 to updated registration request 922 basednot on existing private cryptographic key 274, but instead based onpublic cryptographic key 918 (not illustrated in FIG. 9A), and thatcause client device 122 to transmit updated registration request 922,first digital signature 924, and a regenerated public key certificate(that includes public cryptographic key 916) across network 120 towallet system 130 (also not illustrated in FIG. 9A).

As described herein, the application of first digital signature 924 toupdated registration request 922 may be indicative of user 121'sapproval of, and consent to, the requested registration of publiccryptographic key 916 within the loyalty program, the requestrecordation of public cryptographic key 916 within an element of thepermissioned distributed ledger described herein, and as such, arequested establishment of public cryptographic key 916 as an updatedcryptographic identifier of user 121, client device 102, and executedwallet application 124 within the permissioned distributed ledger.Further, certain of the exemplary process described herein, which couplethe application of first digital signature 924 to registration request922 to a level or type of consent granted by user 121 to wallet system130 and/or gateway system 160 to access and manipulate confidentialdata, may be implemented in addition to, or as an alternate to, existingtoken-based authorization and consent protocols (e.g., an OAuthprotocol, etc.) during the registration processes implementedcollectively by client device 122, wallet system 130, and gateway system160.

As illustrated in FIG. 9A, a secure, programmatic interface establishedand maintained by wallet system 130, such as API 310, may receiveupdated registration request 922, first digital signature 924, and insome instances, public key certificate 308 (or alternatively, theregenerated public key certificate that includes public cryptographickey 916), and may perform any of the exemplary processes describedherein to programmatically trigger an execution of registration engine312 by the one or more processors of wallet system 130. For example,verification module 314 of executed registration engine 312 may receiveupdated registration request 922 (e.g., that includes publiccryptographic key 916, digital token 912, code challenge 920, deviceidentifier 254, and application cryptogram 256), first digital signature924, and public key certificate 308 (or alternatively, the regeneratedpublic key certificate that includes public cryptographic key 916) fromAPI 310.

In some instances, verification module 314 may parse public keycertificate 308 and obtain an existing public cryptographic keyassociated client device 122 (e.g., existing public cryptographic key272 of executed wallet application 124), and perform operations thatverify first digital signature 924 based on existing publiccryptographic key 272. In other instances, and due to the unavailabilityor the compromised nature of existing public cryptographic key 272,verification module 314 may parse the regenerated public key certificateof client device 122 (not illustrated in FIG. 9A) to obtain a publiccryptographic key 916, and perform operations that verify first digitalsignature 924 based on public cryptographic key 916.

If, for example, verification module 314 were unable to verify firstdigital signature 924, verification module 314 may establish thatupdated registration request 922 was either corrupted duringtransmission of altered one or more third parties without permission,and executed registration engine 312 may decline to approve therequested registration and recordation of public cryptographic key 916.In some instances (not illustrated in FIG. 9A), executed registrationengine 312 may generate and transmit an error message across network 120to client device 122, e.g., for presentation within a correspondingdigital interface.

Alternatively, if verification module 314 were to verify first digitalsignature 924, verification module 314 may perform operations thatobtain, from updated registration request 922, digital token 912, deviceidentifier 254, and application cryptogram 256. In some instances,verification module 314 may access credential data store 132, and mayidentify one or more data records 926 that include or reference deviceidentifier 254 or application cryptogram 256, and as such, as associatedwith client device 122 or executed wallet application 124. Asillustrated in FIG. 9A, verification module 314 may obtain, from thedata records 926, a local digital token 928, which is indicative of acurrently valid authentication of the identity of user 121, and performoperations that determine whether digital token 912 (e.g., as receivedfrom client device 122) is consistent with, and corresponds to, localdigital token 928. If, for example, verification module 314 were todetect an inconsistency between digital token 912 and local digitaltoken 928, executed registration engine 312 may decline to furtherprocess updated registration request 922 and may generate and transmitan error message across network 120 to client device 122, e.g., forpresentation within the corresponding digital interface.

Alternatively, based on the verification of first digital signature 924,and based on the determined consistency between digital token 912 andlocal digital token 928, verification module 314 may elect to approveupdated registration request 922 for further processing, and may provideupdated registration request 922, first digital signature 924, and insome instances, public key certificate 308 (or alternatively, theregenerated public key certificate that includes public cryptographickey 916) and as input to consent module 318 of executed registrationengine 312. Further, as illustrated in FIG. 9A, verification module 314may also perform operations that store all or a selected portion ofupdated registration request 922 within a portion of credential datastore 132, e.g., within, or in association with, the one or more datarecords 926.

Consent module 318 may receive updated registration request 922, firstdigital signature 924, and public key certificate 308 (or alternatively,the regenerated public key certificate that includes publiccryptographic key 916), and may obtain a public cryptographic key 320and a corresponding private cryptographic key 322 of wallet system 130from cryptographic data store 134. Public and private cryptographic keys320 and 322 may establish an asymmetric key pair or wallet system 130,which may be generated using one or more of the key generationalgorithms described herein, and public cryptographic key 320 may bedistributed to one or more additional or alternate computing systems anddevices operating within environment 100, such as, but not limited to,program system 140 or gateway system 160.

In some instances, consent module 318 may perform operations that applya second digital signature 930 to registration request 922 (e.g., thatincludes public cryptographic key 916, digital token 912, code challenge920, device identifier 254, and application cryptogram 256) and to firstdigital signature 924. As described herein, the application of seconddigital signature 930 to updated registration request 922 and to firstdigital signature 306 may indicative of an approval of, and a consentto, the requested registration of public cryptographic key 916 withinthe loyalty program, and the requested recordation of publiccryptographic key 916 onto an element of the permissioned distributedledger, by executed registration engine 312 and as such, by walletsystem 130. Executed registration engine 312 may perform operations thatcause wallet system 130 to transmit updated registration request 922,first digital signature 924, second digital signature 930, public keycertificate 308 of client device 122 (e.g., that includes existingpublic cryptographic key 272) and a public key certificate 326 (e.g.,that includes public cryptographic key 320) across network 120 togateway system 160. In other examples, and due to an unavailability or acompromised nature of existing public cryptographic key 272, walletsystem 130 may also transmit the regenerated public key certificate,which includes public cryptographic key 916, in place of public keycertificate 308.

Referring to FIG. 9B, a programmatic interface establish and maintainedby gateway system 160, such as API 328, may receive updated registrationrequest 922, first digital signature 924, second digital signature 930,public key certificate 308 (or alternatively, the regenerated public keycertificate that includes public cryptographic key 916), and public keycertificate 326, and may perform operations that trigger an execution ofverification engine 330 by the one or more processors of gateway system160 (e.g., based on one or more programmatically generated commands). Insome instances, executed verification engine 330 may parse public keycertificate 326 to extract public cryptographic key 320 of wallet system130, and may perform operations that validate second digital signature930 (e.g., as applied to updated registration request 922 and firstdigital signature 924) using public cryptographic key 320.

Further, executed verification engine 330 may also parse public keycertificate 308 to extract existing public cryptographic key 272 ofexecuted wallet application 124, and may perform operations thatvalidate first digital signature 924 (e.g., as applied to updatedregistration request 922) using existing public cryptographic key 272.In other instances, and due to the unavailability or the compromisednature of existing public cryptographic key 272, executed verificationengine 330 may alternatively parse the regenerated public keycertificate of client device 122 (not illustrated in FIG. 9B) to obtaina public cryptographic key 916, and perform operations that verify firstdigital signature 924 based on public cryptographic key 916.

If, for example, executed verification engine 330 were unable to verifyfirst digital signature 924, and additionally, or alternatively, seconddigital signature 930, executed verification engine 330 may decline therequested registration of public cryptographic key 916 and recordationof public cryptographic key 916 within an element of the permissioneddistributed ledger, and may discard updated registration request 922. Insome instances (not illustrated in FIG. 9B), executed verificationengine 330 may generate and transmit an error message across network 120to client device 122 via wallet system 130, e.g., for presentationwithin the corresponding digital interface.

Alternatively, if executed verification engine 330 were to verify firstdigital signature 924 and second digital signature 930, executedverification engine 330 may perform operations that obtain, from updatedregistration request 922, code challenge 920, device identifier 254, andapplication cryptogram 256. In some examples, executed verificationengine 330 may access credential data store 162, and identify one ormore data records 932 that include or reference device identifier 254 orapplication cryptogram 256, and as such, as associated with clientdevice 122 or executed wallet application 124. As illustrated in FIG.9B, executed verification engine 330 may obtain, from the one or more ofdata records 932, a local code challenge 934 (e.g., generated using anyof the exemplary processes described herein), and perform operationsthat determine whether code challenge 920 (e.g., as received from clientdevice 122) is consistent with, and corresponds to, local code challenge934.

As described herein, code challenge 920 may also be associated with anadditional digital signature applied to code challenge 920 by executedwallet application 124 using existing private cryptographic key 274 andadditionally, or alternatively, using public cryptographic key 918. Insome instances, not illustrated in FIG. 9B, executed verification engine330 may perform any of the exemplary processes described herein tovalidate the additional digital signature applied to code challenge 920prior to determining the consistency and correspondence between codechallenge 920 and local code challenge 934.

If, for example, executed verification engine 330 were to detect aninconsistency between code challenge 920 and local code challenge 394(and in some instances, were unable to validate the additional digitalsignature applied to code challenge 920), executed verification engine330 may decline the requested registration of public cryptographic key916 and recordation of public cryptographic key 916 within an element ofthe exemplary permissioned distributed ledgers described herein, and maydiscard updated registration request 922. In some instances (notillustrated in FIG. 9B), executed verification engine 330 may performany of the exemplary processes described herein to generate and transmita corresponding error message across network 120 to client device 122via wallet system 130, e.g., for presentation within the correspondingdigital interface. Alternatively, based on the validation of firstdigital signature 924 and second digital signature 930 (and in someinstances, the validation of the additional digital signature applied tocode challenge 920), and based on the determined consistency betweencode challenge 920 and local code challenge 934, executed verificationengine 330 may approve the requested registration of publiccryptographic key 916, e.g., based on the prior approval of, and consentto, the requested registration by user 121 and wallet system 130, asindicated by respective ones of now-validated first digital signature924 and now-validated second digital signature 930.

As illustrated in FIG. 9B, executed verification engine 330 may provideupdated registration request 922 as an input to distributed registrationengine 336, which may be executed by the one or more processors ofgateway system 160. In some examples, executed distributed registrationengine 336 may perform operations that parse updated recordation request922 to extract public cryptographic key 916, device identifier 254, andapplication cryptogram 256. Further, executed distributed registrationengine 336 may perform operations that package public cryptographic key916, and in some instances, one or more of device identifier 254 andapplication cryptogram 256, into corresponding portions of an updatedregistration object 936, which may be associated with user 121 andexecuted wallet application 124. Further, executed distributedregistration engine 336 may also generate one or more elements ofcertificate chain data 938, which identifies one or more publiccryptographic keys that previously identified user 121, client device122, and executed wallet application 124 within the elements of theexemplary permissioned distributed ledgers described herein, and thatpackages certificate chain data 938 into a corresponding portion ofupdated registration object 936.

For example, although not illustrated in FIG. 9B, executed distributedregistration engine 336 may receive public key certificate 308 of clientdevice 122 in conjunction with updated registration request 922, and mayparse public key certificate 308 to extract existing publiccryptographic key 272, which currently identifies user 121, clientdevice 122, and executed wallet application 124 within the elements ofthe exemplary permissioned distributed ledger described herein. In someinstances, executed distributed registration engine 336 may access alocally maintained version of the permissioned distributed ledger, e.g.,distributed ledger 738 maintained within data repository 161, and mayparse the elements of distributed ledger 738 to identify a correspondingone of the elements that records a registration object that includesexisting public cryptographic key 272, e.g., element 352 that recordsregistration object 338. As illustrated in FIG. 9B, executed distributedregistration engine 336 may obtain, from element 352, an elementidentifier 352A (e.g., a block number) that specifies a sequentialposition of element 352 in relation to the other elements of distributedledger 738, and package element identifier 352A and existing publiccryptographic key 272 within a corresponding portion of certificatechain data 938.

In further examples, not illustrated in FIG. 9B, executed distributedregistration engine 336 may further parse the elements of distributedledger 738 to identify additional ones of the elements that record acorresponding registration object that includes device identifier 254 orapplication cryptogram 256, e.g., as portions of corresponding elementsof registration data. For instance, the registration objects recordedwithin these additional elements may include public cryptographic keysthat identified user 121, client device 122, and executed walletapplication 124 prior to existing public cryptographic key 272, e.g.,that were replaced by existing public cryptographic key 272 through theexemplary key regeneration processes described herein. For each of theadditional identified elements of distributed ledger 738, executeddistributed registration engine 336 may extract the prior publiccryptographic key from the corresponding registration object, and mayobtain an additional positional identifier (e.g., a block number) thatspecifies a sequential position of the corresponding element withindistributed ledger 738. Executed distributed registration engine 336 mayperform operations that package each of the extracted publiccryptographic keys and the corresponding positional identifier withincorresponding portions of certificate chain data 938 (not illustrated inFIG. 9B).

Executed distributed registration engine 336 may perform operations thatapply a digital signature 940 to updated registration object 936 (e.g.,that includes public cryptographic key 916, certificate chain data 938,device identifier 254, and application cryptogram 256) using privatecryptographic key 342 of gateway system 160, e.g., as maintained withincryptographic data store 164. In some instances, executed distributedregistration engine 336 may perform additional operations that causegateway system 160 to broadcast updated registration object 936, digitalsignature 940, and public key certificate 344 of gateway system 160(that includes a public cryptographic key 346 of gateway system 160)across network 120 to one or more of node systems 180, such as nodesystem 182

In some examples, each of the one or more of node systems 180, includingnode system 182, may perform any of the exemplary, consensus-basedoperations described herein to: (i) verify digital signature 940 usingpublic cryptographic key 346 (e.g., as obtained from public keycertificate 344); and (ii) generate an additional element 942 ofdistributed ledger 738 that includes, among other things, updatedregistration object 936 (e.g., public cryptographic key 916, certificatechain data 938, device identifier 254, and application cryptogram 256),a digital signature 944 applied to updated registration object 936(e.g., using a private cryptographic key of corresponding ones of nodesystems 180, including node system 182), a hash value 945 representativeof updated registration object 936 and digital signature 944 (and insome instances, to other elements of distributed ledger 738), and anidentifier 942A (e.g., a “block number”) that specifies a sequentialposition of element 942 in relation to the existing, prior elements ofdistributed ledger 738. The one or more of node systems 180, includingnode system 182, may also perform operations that append element 942 todistributed ledger 738, and generate an updated distributed ledger,e.g., distributed ledger 946.

Further, and based on a successful completion of these exemplaryconsensus-based processes (e.g., the calculation of an appropriateproof-of-work or proof-of-stake, as described herein) prior to otherones of node systems 180, node system 182 may broadcast distributedledger 946, which represents the latest, longest version of thedistributed ledger, to the additional ones of node systems 180 operatingwithin environment 100 and additionally or alternatively, to each of thenetwork-connected systems that participate in the permissioned,distributed-ledger network described herein, such as gateway system 160.As described herein, the recordation of updated registration object 936within element 942 of distributed ledger 946 may confirm theestablishment of public cryptographic key 916 as an updatedcryptographic identifier of user 121, client device 102, and executedwallet application 124 within the elements of cryptographically secure,permissioned distributed ledger 946, and throughout interactions betweenexecuted wallet application 124 of client device 122 and the one or moreapplication programs or program modules executed by wallet system 130and gateway system 160.

Although not illustrated in FIG. 9B, gateway system 160 may receivedistributed ledger 946, and executed distributed registration engine 336of gateway system 160 may store distributed ledger 946 within a portionof the one or more tangible, non-transitory memories, such as datarepository 161 (e.g., to replace distributed ledger 738). Executeddistributed registration engine 336 may also perform operations that,based on the receipt of distributed ledger 946 and the recordation ofupdated registration object 936 within element 942, generate aconfirmation message 948 that confirms the establishment of publiccryptographic key 916 as an updated cryptographic identifier of user121, client device 102, and executed wallet application 124 within theelements of distributed ledger 946, and may perform operations thatcause gateway system 160 to transmit confirmation message 948 acrossnetwork 120 to client device 122, e.g., via wallet system 130.

In some examples, not illustrated in FIG. 9B, client device 122 mayreceive confirmation message 948 through a secure, programmaticinterface, such as an application programming interface (API). Inresponse to the receipt of confirmation message 948, key regenerationmodule 906 of executed wallet application 124 may perform operationsthat invalidate existing public and private cryptographic keys 272 and274, as maintained within cryptographic data store 128, in favor ofregenerated public and private cryptographic keys 916 and 918 (e.g., bygenerating and storing an invalidation flag in conjunction with each ofexisting public and private cryptographic keys 272 and 274 withincryptographic data store 128, by deleting existing public and privatecryptographic keys 272 and 274 from cryptographic data store 128, or byoverwriting existing public and private cryptographic keys 272 and 274with regenerated public and private cryptographic keys 916 and 918).

Upon invalidation of existing public and private cryptographic keys 272and 274 by key regeneration module 906, future interactions andexchanges of data between executed wallet application 124 and otherapplication programs or program modules executed by wallet system 130 orgateway system 160, e.g., regarding an allocation, redemption, ortransfer of digital assets, may reference or include publiccryptographic key 916, and may be digitally signed using publiccryptographic key 918. Further, although not illustrated in FIG. 9B, keyregeneration module 906 may perform further operations that broadcastpublic cryptographic key 916 across network 120 to one or more computingsystems operating within environment 100, such as wallet system 130 andgateway system 160, for storage within corresponding local cryptographicstores, e.g., respective ones of cryptographic data stores 134 and 164.

FIGS. 10A, 10B, and 10C are flowcharts of exemplary processes forsecurely managing and regenerating cryptographic keys within a computingenvironment using permissioned distributed ledgers, in accordance withthe disclosed embodiments. In some examples, a client device thatexecutes a wallet application, such as client device 102 that executeswallet application 104 or client device 122 that executes walletapplication 124, may perform one or more of the exemplary steps ofprocess 1000, as described below in reference to FIG. 10A. Further, acomputing system capable of provisioning and supporting the walletapplications executed by computing devices within the computingenvironment, such as wallet system 130, may perform one or more of theexemplary steps of process 1030, as described below in reference to FIG.10B. Further, a computing system associated with permissioned,distributed-ledger network operating within the environment, such asgateway system 160, may perform one or more of the exemplary steps ofprocess 1060, as described below in reference to FIG. 10C.

Referring to FIG. 10A, client device 102 or client device 122 may accessan existing asymmetric cryptographic key pair associated with anexecuted wallet application, including an existing public cryptographickey and an existing private cryptographic key, maintained within asecure portion of one or more tangible, non-transitory memories (e.g.,in step 1002). In some examples, client device 102 or client device 122may perform any of the exemplary processes described herein to detect anoccurrence of one or more events, e.g., a “regeneration” event, thattrigger a regeneration of existing asymmetric cryptographic key pair,including the existing public and private cryptographic keys (e.g., instep 1004).

For example, each of the existing public and private cryptographic keysmay be associated with a corresponding temporal period of validity, andupon expiration of the corresponding temporal validity period, clientdevice 102 may detect an occurrence of a corresponding one of theregeneration events, e.g., in step 1004. The disclosed embodiments are,however, not limited to regeneration events associated with the temporalvalidity of the existing public and private cryptographic keys, and inother examples, regeneration events consistent with the disclosedembodiments may include, but are not limited to, an establishment by theexecuted wallet application of an additional instance of a mobile walletat client device 102 or client device 122, or a request, by the executedwallet application, to record a registration object associated with thatadditional instance of the mobile wallet onto the exemplary,cryptographically secure and permissioned distributed ledgers describedherein. Examples of these registration events may also include, but arenot limited to, a deletion and reinstallation of the executed walletapplication at client device 102 or client device 122, or a migration ofa user, and the executed wallet application, to anothernetwork-connected computing device or system. Further, in someinstances, regeneration events consistent with the disclosed embodimentsmay also be associated with, and correspond to, instances of fraudulentactivity, such as, but not limited to, an attempted or a successfulbreach, or an unintentional release of confidential data associated withclient device 102 or client device 122, the user of client device 102 orclient device 122, or the executed wallet application.

In response to the detection of the one or more regeneration events(e.g., in step 1004), client device 102 or client device 122 may performany of the exemplary processes described herein to obtain authenticationdata that specifies one or more authentication credentials associatedwith the user of client device 102 or client device 122 and a computingsystem within environment 100 that supports the executed walletapplication, such as wallet system 130 of FIG. 1 (e.g., in step 1006).Examples of these authentication credentials include, but are notlimited to, an alphanumeric login credential, an alphanumeric password,or a biometric credential, such as a facial image or a thumbprint image.

Client device 102 or client device 122 may also perform any of theexemplary processes described herein to request, and receive, a digitaltoken from the computing system within environment 100 that supportsexecuted wallet application 104 and 124, such as wallet system 130 ofFIG. 1 (e.g., in step 1008). In some instances, wallet system 130 maygenerate the digital token in response to a successful authentication ofan identity of the user of client device 102, e.g., based on the obtainauthentication data. As described herein, the digital token maycorrespond to a one-time-use (OTU) token valid to authenticate theidentity of user 101 during a single registration, key-regeneration, ordigital-asset-allocation, -redemption, or -transfer process, and may becharacterized by a predetermined composition, length, or format.

Based on the receipt of the digital token, client device 102 or clientdevice 122 may perform any of the exemplary processes described hereinto regenerate the existing public and private cryptographic keys, and tostore the regenerated public and private cryptographic keys within thesecure portion of one or more tangible, non-transitory memories (e.g.,in step 1010). Further, client device 102 or client device 122 may alsoperform any of the exemplary processes described herein to request andreceive a code challenge from the computing system associated withpermissioned, distributed-ledger network operating within theenvironment, such as gateway system 160 (e.g., in step 1012).

In some instances, client device 102 or client device 122 may performany of the exemplary processes described herein to generate an updatedregistration request that includes the regenerated public cryptographickey, the obtained digital token, the received code challenge, and one ormore elements of registration data (e.g., in step 1014). The elements ofthe registration data may, for example, include a unique deviceidentifier of a respective one of client devices 102 or 122 (e.g., anetwork address, such as an IP address or a MAC address) and a uniqueidentifier of the executed mobile wallet application, such as anapplication cryptogram. Further, client device 102 or client device 122may perform operations that apply a first digital signature to theupdated registration request using the existing public cryptographic keyassociated with the executed wallet application (e.g., in step 1016). Insome instances, the application of the first digital signature to theupdated registration request may be indicative of an approval of, and aconsent to, the requested registration of the regenerated publiccryptographic key within the loyalty program, and the requestedrecordation of the regenerated public cryptographic key within anelement of the permissioned distributed ledger, by the user of clientdevice 102 or 122, e.g., user 101 or 121.

Further, in step 1018, client device 102 or client device 122 maytransmit the updated registration request, the first digital signature,and an existing public cryptographic key of client device 102 or clientdevice 122 across network 120 to the computing system within environment100 that supports the executed wallet application, such as wallet system130. In some examples, wallet system 130 may perform any of theexemplary processes described herein to validate the first digitalsignature and the digital token, and based on the validation of thefirst digital signature and the digital token, to apply a second digitalsignature to the updated registration request and to the first digitalsignature. As described herein, the application of the second digitalsignature to the updated registration request and to the first digitalsignature by wallet system 130 may be indicative of an approval of, anda consent to, the requested registration of the regenerated publiccryptographic key within the loyalty program, and the requestedrecordation of the regenerated public cryptographic key within anelement of the permissioned distributed ledger, by wallet system 130.

As described herein, wallet system 130 may transmit the updatedregistration request, the first digital signature, the second digitalsignature, the existing public key certificate of client device 102 orclient device 122, and a public key certificate of wallet system 130across network 120 to a computing system associated with permissioned,distributed-ledger network operating within the environment, such asgateway system 160. Upon validation of the first digital signature, thesecond digital signature, and the code challenge, gateway system 160 mayperform any of the exemplary processes described herein to generate anupdated registration object that includes the regenerated publiccryptographic key, certificate chain data, and one or more elements ofregistration data, and to record that updated registration elementwithin the element of the permissioned distributed ledger. In someexamples, gateway system 160 may generate and transmit a confirmationmessage that confirms the establishment of the regenerated publiccryptographic key as an updated cryptographic identifier of clientdevice 102 or client device 122, the corresponding user, or thecorresponding executed wallet application across network 120 to clientdevice 102 or client device 122, e.g., via wallet system 130.

Referring back to FIG. 10A, client device 102 or client device 122 mayreceive the confirmation message from gateway system 160 (e.g., in step1020). In some examples, and in response to the receipt of theconfirmation message, client device 102 or client device 122 may performany of the exemplary processes described herein invalidate the existingpublic and private cryptographic keys in favor of the regenerated publicand private cryptographic keys (e.g., in step 1022). By way of example,client device 102 or client device 122 may invalidate the existingpublic and private cryptographic keys by, among other things, bygenerating and storing an invalidation flag in conjunction with each ofthe existing public and private cryptographic keys within the one ormore tangible, non-transitory memories, by deleting the existing publicand private cryptographic keys from the one or more tangible,non-transitory memories, or by overwriting the existing public andprivate cryptographic keys with the regenerated public and privatecryptographic keys 916 and 918. Exemplary process 1000 is then completein step 1024.

Referring to FIG. 10B, wallet system 130 may receive a request toregister a regenerated public cryptographic key (e.g., an “updated”registration request) within one or more elements of a permissioneddistributed ledger, a first digital signature, and a public keycertificate from a client device (e.g., client device 102 or clientdevice 122 of FIG. 1) across network 120 (e.g., in step 1032). Asdescribed herein, the request, e.g., an “updated” registration request,may be generated by a wallet application executed by the client device(e.g., executed wallet application 104 or executed wallet application124), and the registration request may include, among other things, theregenerated public cryptographic key, a digital token generated bywallet system 130 in response to a successful authentication of anidentity of the user (e.g., a one-time-user (OTU) token), and a codechallenge generated by gateway system 160. Further, as also describedherein, the registration request may also include registration data thatincludes, but is not limited to, a device identifier of the clientdevice (e.g., a network address, such as an IP address) and anidentifier of the executed wallet application (e.g., an applicationcryptogram).

In some instances, wallet system 130 may perform any of the exemplaryprocesses described herein to validate the applied first digitalsignature (e.g., in step 1034). If wallet system 130 were unable toverify the first digital signature, (e.g., step 1034; NO), wallet system130 may decline the requested registration of the regenerated publiccryptographic key (e.g., in step 1036). Wallet system 130 may performany of the exemplary processes described herein to generate and transmitan error message to the client device (e.g., in step 1038). Exemplaryprocess 1030 is then complete in step 1040.

Alternatively, if wallet system 130 were to verify the first digitalsignature (e.g., step 1034; YES), wallet system 130 may parse theupdated registration request to extract the digital token (e.g., the OTUtoken) from the updated registration request (e.g., in step 1041), andmay perform any of the exemplary processes described herein to verifythe extracted digital token is consistent with, and corresponds to, alocally maintained copy of the digital token provisioned to the clientdevice (e.g., in step 1042). If, for example, wallet system 130 were todetect an inconsistency between the extracted digital token and thelocal copy of the digital token (e.g., step 1042; NO), exemplary process400 may pass back to step 1036, and wallet system 130 may decline therequested registration of the user as a member of the loyalty program.

Alternatively, if wallet system 130 were to establish a consistency, anda correspondence, between the extracted digital token and the locallymaintained copy of the digital token (e.g., step 1042; YES), walletsystem 130 may approve, and consent to, the requested registration ofthe regenerated public cryptographic key within the loyalty program andto the recordation of the regenerated public cryptographic key withinthe one or more elements of the permissioned distributed ledger (e.g.,in step 1044). Further, wallet system 130 may perform any of theexemplary processes described herein to apply a second digital signatureto the updated registration request and to the first digital signature(e.g., in step 1046). As described herein, the application of the seconddigital signature to the updated registration request and to the firstdigital signature may be indicative of an approval of, and a consent to,the requested registration of the regenerated public cryptographic keyand to the recordation of the regenerated public cryptographic keywithin the one or more elements of the permissioned distributed ledgerby wallet system 130.

In some instances, wallet system 130 may transmit the updatedregistration request, the first digital signature, and the seconddigital signature across network 120 to a computing system associatedwith, and that participates in, the permissioned, distributed-ledgernetwork described herein, such as gateway system 160 (e.g., in step1048). Exemplary process 1030 is then complete in step 1050.

Referring to FIG. 10C, gateway system 160 may receive the updatedregistration request, the first digital signature, and the seconddigital signature from wallet system 130 (e.g., in step 1062). In someinstances, in step 1064, gateway system 160 may perform any of theexemplary processes described herein to validate the first digitalsignature and the second digital signature. If gateway system 160 wereunable to validate the first digital signature or the second digitalsignature, (e.g., step 1064; NO), gateway system 160 may decline therequested registration of the user as a member of the loyalty program(e.g., in step 1066). Gateway system 160 may perform any of theexemplary processes described herein to generate an error messageindicative of the failed verification of the first digital signature andthe declined request, and may transmit the generated error message tothe client device via wallet system 130 (e.g., in step 1068). Exemplaryprocess 1060 is then complete in step 1070.

In other examples, if gateway system 160 were to verify both the firstand second digital signatures (e.g., step 1064; YES), gateway system 160may parse the registration request to extract the code challenge fromthe registration request (e.g., in step 1071), and may perform any ofthe exemplary processes described herein to verify the extracted codechallenge is consistent with, and corresponds to, a locally maintainedcopy of the code challenge provisioned to the client device (e.g., instep 1072). If, for example, gateway system 160 were to detect aninconsistency between the extracted code challenge and the local copy ofthe code challenge (e.g., step 1072; NO), exemplary process 1060 maypass back to step 1064, and gateway system 160 may decline the requestedregistration of the user as a member of the loyalty program.

Alternatively, if gateway system 160 were to establish a consistency,and a correspondence, between the extracted code challenge and thelocally maintained copy of the code challenge (e.g., step 1072; YES),gateway system 160 may approve, and consent to, the requestedregistration of the regenerated public cryptographic key and to therecordation of the regenerated public cryptographic key within the oneor more elements of the permissioned distributed ledger (e.g., in step1074). Gateway system 160 may also perform any of the exemplaryprocesses described herein to generate a updated registration objectassociated with the now-approved updated registration request (e.g., instep 1076), and to generate, and package into the updated registrationobject, certificate chain data that identifies one or more publiccryptographic keys previously identifying the client device, a user ofthe client device, or a wallet application executed at the client devicewithin the elements of the permissioned distributed ledger (e.g., instep 1078). In some instances, gateway system may also performoperations that apply an additional digital signature to the updatedregistration object using a corresponding private cryptographic key(e.g., in step 1080).

Further, gateway system 160 may also perform any of the exemplaryprocesses described herein, in conjunction with one or more node systemsoperating within the computing environment, to record immutably theupdated registration object within an element of a permissioneddistributed ledger, such as within element 942 of updated distributedledger 946 of FIG. 9B (e.g., in step 1082). In some instances, and asdescribed herein, gateway system 160 may receive a confirmation messageindicative of the recordation of the updated registration object withinthe elements of the permissioned distributed ledger, and may route theconfirmation message back to the client device via wallet system 130(e.g., in step 1084). Exemplary process 1060 is then complete in step1086.

E. Secure Initiation and Management of Transfers of Digital AssetsBetween Computing Devices Using Permissioned Distributed Ledgers

In some instances, a cryptographically secure, permissioned distributedledger, such as distributed ledger 946 of FIG. 9B, may recordregistration objects that confirm a successful registration of one ormore customers of a financial institution, such as users 101 and 121, asmembers of a loyalty program associated with that financial institution,and also record allocation objects that identifying and characterize aredeemable and transferrable digital asset, or a predetermined quantityof the digital asset, allocated to user 101, user 121, and other membersof the loyalty program in response to a successful completion of theexemplary registration processes described herein, in response to asuccessful participation in the exemplary referral processes describedherein, or in response to an initiation of a qualifying transactioninvolving the loyalty program or the financial institution.Additionally, and as described herein, the elements of distributedledger 946 may also record one or more redemption objects thatidentifying and characterize specified digital assets, or quantities ofthe digital assets, redeemed by user 101, user 121, and other members ofthe loyalty program in exchange for physical or virtual products offeredby the loyalty program.

As described herein, the initial registration of a corresponding memberof the loyalty program, and the digital assets allocated to that memberor redeemed by that member, may be tracked within the elements ofdistributed ledger 946 through a unique cryptographic identifierassociated with that member, a device operable by that member, of awallet application executed by that device, such as, but not limited to,public cryptographic key 518 associated with user 101, client device102, and executed wallet application 104, or public cryptographic key272 associated with user 121, client device 122, and executed walletapplication 124. Further, certain of the exemplary embodiments describedherein may leverage these member-specific cryptographic identifiers tofacilitate peer-to-peer (P2P) transfers of digital assets betweenindividual members of the loyalty program (such as users 101 and 121)and further, between a member of the loyalty program (such as user 101or user 121) and a member of an additional, unrelated loyalty program inaccordance with an agreed-upon exchange rate.

For example, user 121 may hold hockey tickets for an upcoming game, andmay agree to transfer the hockey tickets to user 101 in exchange for aspecified quantity of digital assets held by user 101, such as fiftyunits of digital coin allocated to user 101 through any of the exemplaryallocation processes described herein. In some instances, and based onthe agreement with user 121 regarding the transfer of the hockey ticketsin exchange for the agreed-upon quantity of the digital asset, user 101may provide input to client device 102, e.g., via input unit 222, thattriggers and execution of wallet application 104. Based on theprovisioned input, executed wallet application 104 may generate one ormore interface elements that, when rendered for presentation by displayunit 218, collectively establish one or more display screens of atransfer interface, which prompt user 101 to provide further input toclient device 102 that specifies, among other things, a value of one ormore parameters of a desired P2P transaction that transfers digitalassets between user 101 and a corresponding counterparty, such as user121, and one or more identifiers of the counterparty to the desired P2Ptransaction, such as a public cryptographic key of user 121.

Referring to FIG. 11A, a display screen 1102 of peer-to-peer (P2P)transfer interface 1100 may include one or more interactive interfaceelements, such as a fillable text box 1104, which receives and displaysinput from user 101 specifying a quantity of digital assets subject totransfer through the desired P2P transaction, and a fillable text box1106, which receives and displays additional input from user 101specifying a public cryptographic key associated with the counterpartyto the desired P2P transaction, such as public cryptographic key 916 ofexecuted wallet application 124. Further, display screen 1101 may alsoinclude an additional interface element, e.g., “SUBMIT” icon 1108, whichupon selection by user 101, causes executed wallet application 104 toperform operations that initiate one or more of the exemplary processesdescribed herein to transfer the specified quantity of the digitalassets to the counterparty, e.g., based on corresponding transactionrecorded onto an element of the permissioned distributed ledgerdescribed herein, such as distributed ledger 946.

In some examples, the additional user input that specifies the publiccryptographic key of user 121, e.g., the counterparty to the desired P2Ptransaction, may include an alphanumeric character string entered byuser 101 into input unit 222 of client device 102, e.g., a miniaturizedkeyboard presented a pressure-sensitive touchscreen display unit ofclient device 102. In other examples, the additional user input maycorrespond to a selection of selectable icon 1110, which cause the oneor more processors of client device 102 to capture, via a digital cameraof client device 102, a digital image of a visual representation of thepublic cryptographic key of user 121, such as, but not limited to, adigital image of a UPC or QR code presented within a correspondinginterface of client device 122. The disclosed embodiments are, however,not limited to these exemplary elements of input that specify the publiccryptographic key of the counterparty to the desired P2P transaction,and on other examples, the additional user input, e.g., to fillable textbox 1106 may include one or more additional or alternate identifiers ofthe counterparty, such as a login credential, email address, ortelephone number of user 101, which executed wallet application 104 orwallet system 130 may associate with the corresponding publiccryptographic key.

For example, and upon viewing display screen 1102 of P2P transferinterface 1100, user 101 may provide input 1112 to client device 102 viainput unit 222. In some instances, input 1112 may specify, withinfillable text box 1104, the quantity of digital assets subject totransfer through the desired P2P transaction (e.g., the fifty digitalcoins), and may also specify, within fillable text box 1106, thealphanumeric character string corresponding to the public cryptographickey of user 121 (e.g., “1018375387394736” for a 128-bit publiccryptographic key). Further, input 1112 may also correspond to theselection of “SUBMIT” icon 1108. Further, although not illustrated inFIG. 11A the selection of SUBMIT″ icon 1108 may cause display unit 218to present interface elements that establish one or more additionaldisplay screens of P2P transaction interface 1100, and that prompt user101 to provide further input specifying one or more authenticationcredentials of user 101, such as, but not limited to, a logincredential, an alphanumeric password, or a biometric credential (e.g., athumbprint image, a facial image, etc.). In some instances, theprovisioning of the one or more authentication credentials in responseto the selection of “SUBMIT” icon 1108 may further confirm the intentionof user 101 to initiate a P2P transaction that transfers the specifiedquantity of the digital assets (e.g., the fifty units of the digitalcoin) to user 121 (e.g., via the public cryptographic key provisioned tofillable text box 1106). In some instances, input unit 222 may routeinput data 1114 representative of input 1112 to a transaction engine1116 of executed wallet application 104.

Transaction engine 1116 may receive input data 1114, and may parse inputdata 1114 to detect the requested initiation of the P2P transaction andto extract, from input data 1114, transaction parameter data 1118 andcounterparty data 1120, which P2P transaction engine 1116 may storewithin a portion of the one or more tangible, non-transitory memories ofclient device 102, e.g., within transaction data store 110. In someinstances, transaction parameter data 1118 may identify and characterizethe type and quantity of the digital assets subject to transfer throughthe desired P2P transaction (e.g., the fifty units of the digital coin),and counterparty data 1120 may include the alphanumeric character stringcorresponding to the public cryptographic key of user 121 (e.g.,“1018375387394736”, as described herein). Further, in some instances,transaction engine 1116 may also parse input data 1114 to extractauthentication data 1122 (e.g., the login credential, alphanumericpassword, or biometric credential of user 101), which P2P transactionengine 116 may store within a portion of credential data store 106,e.g., in association with device identifier 506 (e.g., the IP address ofclient device 102), application cryptogram 508 (e.g., that uniquelyidentifies executed wallet application 104), and customer profile data510 (e.g., the identifies and characterizes user 101).

In some instances, and prior to initiating the requested P2P transactionin accordance with the elements of transaction parameter data 1118,transaction engine 1116 of executed wallet application 104 may performany of the exemplary processes described herein that, in conjunctionwith gateway system 160 and node systems 180, determine a currentbalance of digital assets held by user 101 and available for transferfrom user 101 to user 121. Based on the determined current balance ofthe digital assets held by user 101 (e.g., the quantity of digital coinsavailable for transfer), transaction engine 1116 may establish whetherthe determined current balance is equivalent to, or exceeds, thequantity of the digital asset (e.g., the fifty units of the digitalcoin) subject to transfer through the desired P2P transaction. If, forexample, P2P transaction engine 1116 were to determine that theavailable balance of the digital assets is insufficient to support thedesired P2P transaction (e.g., that the quantity of the digital assetsubject to transfer exceeds the current balance), transaction engine1116 may decline to initiate the desired P2P transaction, and executedwallet application 104 may perform operations that generate and presentan error message within an additional display screen of P2P transactioninterface 1100. Alternatively, if transaction engine 1116 were todetermine that the available balance of the digital assets is sufficientto support the desired P2P transaction (e.g., that the current balanceof the digital asset exceeds the quantity of the digital asset subjectto redemption), transaction engine 1116 may perform additionaloperations that, in conjunction with wallet system 130 and gatewaysystem 160, initiate the desired P2P transaction that transfers thespecified quantity of the digital asset (e.g., the fifty units of thedigital coin) to user 121 (e.g., via the public cryptographic keyspecified within counterparty data 1120).

For example, although not illustrated in FIG. 11A, transaction engine1116 may perform any of the exemplary processes described herein torequest, and receive, a digital token 1124 from wallet system 130 (e.g.,in response to a successful authentication process between executedwallet application 104 and wallet system 130 based on authenticationdata 1122), and to request, and receive, a code challenge 1126 fromgateway system 160. In some instances, transaction engine 1116 may storedigital token 1124 and code challenge 1126 within a portion ofcredential data store 106 associated with authentication data 1122,device identifier 506, application cryptogram 508, and customer profiledata 510. As described herein, digital token 1124 may correspond to aone-time-use (OTU) token, and may be characterized by a predeterminedcomposition, length, or format. Further, code challenge 1126 may begenerated by gateway system 160 using any of the exemplary processesdescribed herein, and correspond to a hash value representative of allor a selected portion of device identifier 506 and/or applicationcryptogram 508, or may correspond to a hash value representative of aplaintext cipher maintained confidentially by gateway system 160.

Transaction engine 1116 may also package, into corresponding portions ofa transaction request 1128, public cryptographic key 518 of executedwallet application 104 and user 101 (e.g., that identifies a payer andinitiating party of the desired P2P transaction), all or a selectedportion of counterparty data 1120 (e.g., that specifies the publiccryptographic key of user 121, and as such, the payee of the desired P2Ptransaction), transaction parameter data 1118 (e.g., the specifiedquantity of the digital asset subject to transfer), digital token 1124,and code challenge 1126, e.g., in addition to device identifier 506,and/or application cryptogram 508. Further, although not illustrated inFIG. 11A, transaction engine 1116 may also apply a digital signature tocode challenge 1126 prior to packaging code challenge 1126 into acorresponding portion of transaction request 1128.

In some instances, transaction engine 1116 of executed walletapplication 104 may also perform operations that apply a first digitalsignature 1130 to transaction request 1128 using private cryptographickey 520 of executed wallet application 104, as maintained securelywithin cryptographic data store 108. In some examples, the applicationof first digital signature 1130 to transaction request 1128 may beindicative of an approval of, and a consent to, the requested P2Ptransaction that transfers the fifty units of the digital coin from user101 to user 121, e.g., in exchange for the hockey tickets. Further,certain of the exemplary process described herein, which couple theapplication of first digital signature 1130 to transaction request 1128to a level or type of consent granted by user 101 to wallet system 130and/or gateway system 160 to access or manipulate confidential data, maybe implemented in addition to, or as an alternate to, existingtoken-based authorization and consent protocols (e.g., an OAuthprotocol, etc.) during the asset-allocation processes implementedcollectively by client device 102, wallet system 130, and gateway system160.

Transaction engine 1116 may also perform operations that cause clientdevice 102 to transmit transaction request 1128, first digital signature1130, and in some instances, public key certificate 528 of client device102 (which includes public cryptographic key 518) across network 120 towallet system 130. As illustrated in FIG. 11A, a secure, programmaticinterface established and maintained by wallet system 130, such asapplication programming interface (API) 1127, may receive transactionrequest 1128, first digital signature 1130, and in some instances,public key certificate 528, and may programmatically trigger (e.g.,based on a generation of one or more electronic commands) an executionof a transaction engine 1132 by the one or more processors of walletsystem 130.

For example, a verification module 1134 of executed transaction engine1132 may receive transaction request 1128, first digital signature 1130,and public key certificate 528 from API 1127. In some instances,verification module 1134 may parse public key certificate 528 and obtaina public cryptographic key associated client device 102 (e.g., publiccryptographic key 518 of executed wallet application 104), and performoperations that verify first digital signature 1130 based on theobtained public cryptographic key. If, for example, verification module1134 were unable to verify first digital signature 1130, verificationmodule 1134 may establish that transaction request 1128 was eithercorrupted during transmission of altered one or more third partieswithout permission, and executed transaction engine 1132 may decline therequested P2P transaction. In some instances (not illustrated in FIG.11A), executed transaction engine 1132 may generate and transmit anerror message across network 120 to client device 102, e.g., forpresentation within a corresponding digital interface, such as a displayscreen of P2P transaction interface 1100.

Alternatively, if verification module 1134 were to verify first digitalsignature 1130, verification module 1134 may perform operations thatobtain device identifier 506, application cryptogram 508, and digitaltoken 1124 from transaction request 1128, and may identify one or moredata records 1135 within credential data store 132 that include orreference device identifier 506 or application cryptogram 508, and assuch, are associated with client device 102 or executed walletapplication 104. As illustrated in FIG. 11A, verification module 1134may obtain, from data records 1135, a local digital token 1136, which isindicative of a currently valid authentication of the identity of user101, and perform operations that determine whether digital token 1124(e.g., as received from client device 102) is consistent with, andcorresponds to, local digital token 1136. If, for example, verificationmodule 1134 were to detect an inconsistency between digital token 1124and local digital token 1136, executed transaction engine 1132 maydecline the requested P2P transaction and may generate an error message,which wallet system 130 may transmit across network 120 to client device102, e.g., for presentation within a display screen of P2P transactioninterface 1100.

In other instances, based on the verification of first digital signature1130, and based on the determined consistency between digital token 1124and local digital token 1136, verification module 1134 may approve therequested P2P transaction that transfers the specifies quantity of thedigital asset (e.g., the fifty units of the digital coin) from user 101to user 121. Further, in some examples, and prior to further processingof transaction request 1128, verification module 1134 may performoperations that verify the status of user 121 as a member of the loyaltyprogram associated with a client device (e.g., client device 122)executing a valid wallet application provisioned by wallet system 130(e.g., executed wallet application 124).

For example, verification module 1134 may obtain counterparty data 1120from transaction request 1128, and parse cryptographic data store 138 toverify locally maintained public cryptographic key (e.g., publiccryptographic key 916, which client device 122 broadcasted to walletsystem 130 through the exemplary key regeneration processes describedherein), and determine that the public cryptographic key specifiedwithin counterparty data 1120 corresponds to the locally maintainedcryptographic key associated with user 121, client device 122, andexecuted wallet application 124. In other examples, not illustrated inFIG. 11A, verification module 1134 may transmit all or a selectedportion of counterparty data 1120 across network 120 to gateway system160, which may perform operations that, in conjunction with node systems180, determine whether the public cryptographic key specified withincounterparty data 1120 corresponds to a public cryptographic key of user121 maintained within a registration object recorded onto thepermissioned distributed ledger (e.g., within updated registrationobject 936 recorded onto element 942 of permissioned distributed ledger946) or a prior, invalid cryptographic key of user 121 linked to acurrently valid public cryptographic key through one or more elements ofcertificate chain data (e.g., certificate chain data 938 maintainedwithin updated registration object 936).

Referring back to FIG. 11A, and based on the approval of the requestedP2P transaction between user 101 and user 121, verification module 1134may provide transaction request 1128, first digital signature 1130, andin some instances, public key certificate 528 and as input to a consentmodule 1138 of executed transaction engine 1132. As described herein,transaction request 1128 may include, but is not limited to, publiccryptographic key 518 associated with user 101, all or the selectedportion of counterparty data 1120 (e.g., that specifies the publiccryptographic key associated with user 121), transaction parameter data1118, digital token 1124, code challenge 1126, device identifier 506and/or application cryptogram 508. Consent module 1138 may, in someexamples, perform any of the exemplary processes described herein toapply a second digital signature 1140 to transaction request 1128 and tofirst digital signature 1130, e.g., using private cryptographic key 322of wallet system 130, as maintained within cryptographic data store 134.As described herein, the application of second digital signature 1140 totransaction request 1128 and to first digital signature 1130 mayindicative of an approval of, and a consent to, the requested P2Ptransaction that transfers the specified quantity of the digital asset(e.g., the fifty units of the digital coin) from user 101 to user 121(e.g., via the public cryptographic key specified within counterpartydata 1120). Executed transaction engine 1132 may perform operations thatcause wallet system 130 to transmit transaction request 1128, firstdigital signature 1130, second digital signature 1140, public keycertificate 528 of client device 102 (e.g., that includes publiccryptographic key 518) and public key certificate 326 (e.g., thatincludes public cryptographic key 320 of wallet system 130) acrossnetwork 120 to gateway system 160.

Referring to FIG. 11B, a programmatic interface establish and maintainedby gateway system 160, such as API 328, may receive transaction request1128, first digital signature 1130, second digital signature 1140, andpublic key certificates 326 and 528, and may perform operations thattrigger an execution of verification engine 330 by the one or moreprocessors of gateway system 160. In some instances, executedverification engine 330 may parse public key certificate 528 to extractpublic cryptographic key 518 of executed wallet application 104, and mayparse public key certificate 326 to extract public cryptographic key 320of wallet system 130. Executed verification engine 330 may performoperations that validate second digital signature 1140 (e.g., as appliedto transaction request 1128 and first digital signature 1130) usingpublic cryptographic key 320 and further, that validate first digitalsignature 1130 (e.g., as applied to transaction request 1128) usingpublic cryptographic key 518.

If, for example, executed verification engine 330 were unable to verifyfirst digital signature 1130, and additionally, or alternatively, seconddigital signature 1140, executed verification engine 330 may decline therequested P2P transaction, and may discard transaction request 1128. Insome instances (not illustrated in FIG. 11B), executed verificationengine 330 may generate and transmit an error message across network 120to client device 102 via wallet system 130, e.g., for presentationwithin a display screen of P2P transaction interface 1100.

Alternatively, if executed verification engine 330 were to verify firstdigital signature 1130 and second digital signature 1140, executedverification engine 330 may perform operations that obtain, fromtransaction request 1128, code challenge 1126, device identifier 506,and/or application cryptogram 508. In some examples, executedverification engine 330 may access credential data store 162, andidentify one or more data records 1142 that include or reference deviceidentifier 506 or application cryptogram 508, and as such, as associatedwith client device 102 or executed wallet application 104. Asillustrated in FIG. 11B, executed verification engine 330 may obtain,from data records 1142, a local code challenge 1144 (e.g., generatedusing any of the exemplary processes described herein), and performoperations that determine whether code challenge 1126 (e.g., as receivedfrom client device 102) is consistent with, and corresponds to, localcode challenge 1144.

As described herein, code challenge 1126 may also be associated with anadditional digital signature applied to code challenge 1126 by executedwallet application 124 using private cryptographic key 520. In someinstances, not illustrated in FIG. 11B, executed verification engine 330may perform any of the exemplary processes described herein to validatethe additional digital signature applied to code challenge 1126 prior todetermining the consistency and correspondence between code challenge1126 and local code challenge 1144.

If, for example, executed verification engine 330 were to detect aninconsistency between code challenge 1126 and local code challenge 1144(and in some instances, were unable to validate the additional digitalsignature applied to code challenge 1126), executed verification engine330 may decline the requested P2P transaction, and may discardtransaction request 1128. In some instances (not illustrated in FIG.11B), executed verification engine 330 may perform any of the exemplaryprocesses described herein to generate and transmit a correspondingerror message across network 120 to client device 102 via wallet system130, e.g., for presentation within a display screen of P2P transactioninterface 1100. Alternatively, based on the validation of first digitalsignature 1130 and second digital signature 1140 (and in some instances,the validation of the additional digital signature applied to codechallenge 1126), and based on the determined consistency between codechallenge 1126 and local code challenge 1144, executed verificationengine 330 may validate the requested P2P transaction between user 101and user 121.

As illustrated in FIG. 11B, executed verification engine 330 may provideapproved transaction request 1128 as an input to a distributedtransaction engine 1146, which may be executed by the one or moreprocessors of gateway system 160. In some examples, executed distributedtransaction engine 1146 may perform operations that determine acompliance of the requested, and now-validated, P2P transaction complieswithin one or more P2P transaction rules established by the loyaltyprogram or by the financial institution associated with the loyaltyprogram. For instance, executed distributed transaction engine 1146 mayaccess rules database 168 of data repository 161, and obtain rules data1148 that, among other things, and identify and characterize one or moreP2P transaction rules that impose corresponding conditions on therequested P2P transaction. Examples of these imposed conditions mayinclude, but are not limited to, a minimum or maximum quantity ofdigital assets subject to transfer through the requested P2P transaction(e.g., lower or upper transaction bounds) or a maximum velocity for P2Ptransactions involving user 101 or user 121 (e.g., an upper bound on anumber of executed P2P transactions during a predetermined time period).

If, for example, executed distributed transaction engine 1146 mayestablish an inconsistency between at least one of the conditionsimposed by the one or more P2P transaction rules and requested P2Ptransaction, executed distributed allocation engine 546 may decline therequested P2P transaction and may generate an error message, whichgateway system 160 may transmit across network 120 to client device 102via wallet system 130, e.g., for presentation within a display screen ofP2P transaction interface 1100. Alternatively, if executed distributedtransaction engine 1146 were to establish a consistency between theconditions imposed by the one or more P2P transaction rules andrequested P2P transaction, executed distributed transaction engine 1146may also apply one or more fraud detection and mitigation processes tothe now-verified allocation request (not illustrated in FIG. 11B). Byway of example, the applied fraud detection and mitigation processes mayalso be specified within rules database 168, and may include adding datacharacterizing the P2P transaction request to a queue of pending P2Ptransaction, which may delay processing that executed the requestedallocates the digital asset, or the predetermined quantity of thedigital asset, to user 101 predetermined or dynamically determined timeperiod. In some instances, and upon expiration of the predetermined ordynamically determined time period, executed distributed transactionengine 1146 may establish a successful outcome of the fraud detectionand mitigation processes, and may approve the requested P2P transactionbetween user 101 and user 121.

In some instances, and based on the approval of the requested P2Ptransaction, executed distributed transaction engine 1146 may performoperations that generate discrete transaction objects for thenow-approved P2P transaction that, upon recordation within one or moreelements of the permissioned distributed ledger using any of theexemplary consensus-based processes described herein, execute the P2Ptransaction by debiting the specified quantity of the digital assets(e.g., the fifty units of the digital coin) from the current balance ofdigital assets held by user 101 and by crediting the specified quantityof the digital assets to the current balance of digital assets held byuser 121. For example, executed distributed transaction engine 1146 mayobtain, from transaction request 1128, public cryptographic key 518associated with user 101 (e.g., and executed wallet application 104),all of the selected portion of counterparty data 1120 (e.g., thatincludes the specified public cryptographic key of user 121), andtransaction parameter data 1118, which includes the specified quantityof the digital assets subject to transfer from user 101 to user 121through the now-approved P2P transaction (e.g., the fifty digitalcoins). As described herein, executed distributed transaction engine1146 may perform operations that store public cryptographic key 518,counterparty data 1120, and transaction parameter data 1118 within oneor more of the tangible, non-transitory memories of gateway system 160,e.g., within a portion of data repository 161 (not illustrated in FIG.11B).

Executed distributed transaction engine 1146 may also perform operationsthat generate, for the now-approved P2P transaction, a payer transactionobject 1150 and a payee transaction object 1152 that, when recordedwithin an additional element of the permissioned distributed ledgerdescribed herein, e.g., distributed ledger 946 of FIG. 9B, executed theP2P transaction and effect an atomic transfer of the specified quantityof the digital assets from user 101 to user 121 via the permissioneddistributed ledger. For example, as illustrated in FIG. 11B, executeddistributed transaction engine 1146 may package public cryptographic key518, which uniquely identifies user 101 and executed wallet application104, within a corresponding portion of payer transaction object 1150.

Further, executed distributed transaction engine 1146 may performadditional operations that extract, from counterparty data 1120, acandidate public key 1154 associated with user 121 (e.g., as specifiedby user 101 in response to display screen 1102 of P2P transactioninterface 1100), and that confirm that candidate public key 1154corresponds to a currently valid public cryptographic key that uniquelyidentifies user 121 and executed wallet application 124 within theelements of distributed ledger 946. For example, although notillustrated in FIG. 11B, executed distributed transaction engine 1146may access permissioned distributed ledger 946, and determine thatcandidate public key 1154 corresponds to public cryptographic key 916maintained within updated registration object 936, which may be recordedwithin element 942 of permissioned distributed ledger 946. Further, andbased on portions of registration data maintained within updatedregistration object 936, such as device identifier 254 and applicationcryptogram 256, executed distributed transaction engine 1146 may furtherparse the elements of permissioned distributed ledger 946 to establishthat element 942 records the most temporally recent registration orupdated registration block associated with user 121, client device 122,and executed wallet application 124, and as such, that candidate publickey 1154 represents the currently valid public cryptographic keyassociated with user 121. In some examples, illustrated in FIG. 11B,executed distributed transaction engine 1146 may package candidatepublic key 1154 within a corresponding portion of payee transactionobject 1152.

In other instances, (also not illustrated in FIG. 11B) executeddistributed transaction engine 1146 may detect an inconsistency betweencandidate public key 1154 and the currently valid public cryptographickey 916 recorded within updated registration object 936 ofdistributed-ledger element 942. Responsive to the detectedinconsistency, executed distributed transaction engine 1146 may parsethe elements of permissioned distributed ledger 946 to establish thatelement 942 records the most temporally recent registration or updatedregistration block associated with user 121, client device 122, andexecuted wallet application 124 (e.g., based on portions of theregistration data maintained within updated registration object 936,such as device identifier 254 and application cryptogram 256), andfurther, may obtain one or more elements of certificate chain data 938from updated registration block object 936. As described herein, theelements of certificate chain data 938 may specify one or more publiccryptographic keys (now invalidated) that previously identified user121, client device 122, and executed wallet application 124 within theelements of the permissioned distributed ledger 946 (and the otherexemplary permissioned distributed ledgers described herein), andexecuted distributed transaction engine 1146 may perform operations thatdetermine whether the one or more prior public cryptographic keysinclude candidate public key 1154.

If, for example, executed distributed transaction engine 1146 were toestablish that the one or more prior public cryptographic keys excludecandidate public key 1154, executed distributed transaction engine 1146may determine that candidate public key 1154 is invalid for therequested P2P transaction (not illustrated in FIG. 11B). In someinstances, executed distributed transaction engine 1146 may generate andtransmit an error message across network 120 to client device 102 viawallet system 130, e.g., for presentation within a corresponding digitalinterface, such as a display screen of P2P transaction interface 1100(also not illustrated in FIG. 11B).

In other instances, executed distributed transaction engine 1146 were toestablish that the one or more prior public cryptographic keys includecandidate public key 1154, executed distributed transaction engine 1146may establish an association between candidate public key 1154 and user121 or executed wallet application 124, and as such, between candidatepublic key 1154 and the currently valid public cryptographic keyassociated with user 121, e.g., public cryptographic key 916. In someinstances, not illustrated in FIG. 11B, executed distributed transactionengine 1146 may package currently valid public cryptographic key 916within a corresponding portion of payee transaction object 1152, e.g.,instead of the specified, but not currently invalid, candidate publickey 1154.

Referring back to FIG. 11B, executed distributed transaction engine 1146may extract the data that identifies the quantity of the digital assetsubject to transfer through the P2P transaction (e.g., the fifty unitsof the digital coin) from transaction parameter data 1118, and maypackage the extracted data into corresponding ones of debit data 1156and credit data 1158. Further, in some instances, executed distributedtransaction engine 1146 may also package debit data 1156 into acorresponding portion of payer transaction object 1150, and credit data1158 into a corresponding portion of payee transaction object 1152. Asdescribed herein, when recorded onto one or more additional elements ofdistributed ledger 946, respective ones of payee and payer transactionobjects 1150 and 1152 may execute the requested and approved P2Ptransaction between user 101 and user 121, may debit the specifiedquantity of the digital asset (e.g., as maintained within debit data1156) from the current balance of the digital asset held by user 101,and may credit the specified quantity of the digital asset (e.g., asmaintained within credit data 1158) to the current balance of thedigital asset held by user 121.

In some examples, executed distributed transaction engine 1146 and mayalso apply a digital signature 1159 to payer transaction object 1150,and may apply a digital signature 1160 to payee transaction object 1152,using private cryptographic key 342 of gateway system 160, e.g., asmaintained within cryptographic data store 164. Further, executeddistributed transaction engine 1146 may perform additional operationsthat cause gateway system 160 to broadcast payer transaction object 1150and applied digital signature 1159, payee transaction object 1152 andapplied digital signature 1160, and public key certificate 344 (thatincludes public cryptographic key 346 of gateway system 160) acrossnetwork 120 to one or more of node systems 180, such as node system 182.As illustrated in FIG. 11B, a programmatic interface established andmaintained by each of node systems 180, such as API 348 of node system182, may receive and route payer transaction object 1150, payeetransaction object 1152 applied digital signatures 1159 and 1160, andpublic key certificate 344 to a corresponding block generation engine,such as block generation engine 350 of node system 182.

In some examples, each of the one or more of node systems 180, includingnode system 182, may perform any of the exemplary, consensus-basedoperations described herein to: (i) verify digital signatures 1159 and1160 using public cryptographic key 346 (e.g., as obtained from publickey certificate 344); and (ii) generate an additional element 1162 ofdistributed ledger 946 that includes, among other things, payertransaction object 1150 (e.g., which itself includes debit data 1156 andpublic cryptographic key 518 of executed wallet application 104), payeetransaction object 1152 (e.g., which itself includes credit data 1158and the public cryptographic key associated with user 121 and executedwallet application 124), a digital signature 1164 applied to payer andpayee transaction objects 1150 and 1152 (e.g., using a privatecryptographic key of corresponding ones of node systems 180, includingnode system 182), a hash value 1166 representative of payer and payeetransaction objects 1150 and 1152 and digital signature 1164 (and insome instances, to other elements of distributed ledger 564), and anidentifier 1162A (e.g., a “block number”) that specifies a sequentialposition of additional element 1162 in relation to the existing, priorelements of distributed ledger 946. Further, and through any of theexemplary, consensus-based processes described herein, each of the oneor more of node systems 180, including node system 182, may appendadditional element 1162 to distributed ledger 946 to generate an updateddistributed ledger, e.g., distributed ledger 1168.

Further, and based on a successful completion of these exemplaryconsensus-based processes (e.g., the calculation of an appropriateproof-of-work or proof-of-stake, as described herein) prior to otherones of node systems 180, node system 182 may broadcast distributedledger 1168, which represents the latest, longest version of thedistributed ledger, to the additional ones of node systems 180 operatingwithin environment 100 and additionally or alternatively, to each of thenetwork-connected systems that participate in the permissioned,distributed-ledger network described herein, such as gateway system 160.As described herein, the recordation of payer transaction object 1150within element 1162 of distributed ledger 1168 may implement an atomictransfer that debits the specified quantity of the digital asset (e.g.,the fifty units of the digital coin) from the current balance of thedigital asset held by user 101, and the recordation of payee transactionobject 1152 within element 1162 of distributed ledger 1168 may implementan atomic transfer that credits the specified quantity of the digitalasset (e.g., the fifty digital coins) to the current balance of thedigital asset held by user 121.

Although not illustrated in FIG. 11B, Gateway system 160 may receiveupdated distributed ledger 1168, and executed distributed transactionengine 1146 of gateway system 160 may store distributed ledger 1168within a portion of the one or more tangible, non-transitory memories,such as data repository 161 (e.g., to replace distributed ledger 946).Executed distributed transaction engine 1146 may also perform operationsthat, based on the receipt of distributed ledger 1168 and the payer andpayee transaction objects 1150 and 1152 within element 1162, generatemessages confirming the now-executed P2P transaction and the transfer ofthe specified quantity of the digital assets (e.g., the fifty digitalcoins) from user 101 to user 121, gateway system 160 may transmit theconfirmation messages across network 120 to client devices 102 and 122via wallet system 130 (not illustrated in FIG. 11B).

In some instances, the cryptographically secure, permissioneddistributed ledger described herein, such as distributed ledger 1168 ofFIG. 11B, may immutably record transaction objects that facilitatepeer-to-peer (P2P) transactions between members of a correspondingloyalty program, such as user 101 and user 121. By way of example, theP2P transactions may a transfer of a specified quantity of a digitalasset allocated by the loyalty program from a first member, such as user101, to a second member, such as user 121, and the recordation of thetransaction objects onto distributed ledger 1168 (e.g., using theexemplary consensus-based processes described herein) may execute afirst atomic transfer that debits a specified quantity of a digitalasset from a current balance of the digital asset held by user 101, anda second atomic transfer that credits the specified quantity of thedigital asset to a current balance of the digital asset held by user121. Further, and as described herein, the initial registration of eachmember of the loyalty program, and the digital assets allocated to,redeemed by, or transferred to or from each of the members, may betracked within the elements of distributed ledger 1168 through a uniquecryptographic identifier associated with each member, a device operableby that member, of a wallet application executed by that device, suchas, but not limited to, a public cryptographic key generated, orregenerated, using any of the exemplary processes described herein.

In other instances, certain of the exemplary processes described hereinmay leverage the cryptographically secure and permissioned distributedledger to facilitate, and immutably track, peer-to-peer (P2P)transactions that exchange specified quantities of the digital assetallocated by the loyalty program associated with the financialinstitution for corresponding quantities of additional digital assetsallocated to members of one or more additional loyalty program inaccordance with corresponding exchanges rates established by mutualagreement between corresponding pairs of the loyalty programs. Forexample, the loyalty program associated with the financial institution(e.g., a “first” loyalty program) may cooperate with a second loyaltyprogram, such as an air-miles reward program, to establish collectivelyan incentive campaign by which a member of the first and second loyaltyprograms, such as user 101, may exchange a first digital asset allocatedby the first loyalty program (e.g., the units of the first digital coindescribed herein) for a predetermined quantity, or fraction, of a seconddigital asset allocated by the second loyalty program, e.g., inaccordance with a predetermined and mutually agreed-upon exchange rate,or by which the member of the first loyalty program, such as user 101,may initiate a transfer of a specified quantity of the first digitalasset to an additional member of the second loyalty program, e.g., basedon a conversion of the specified quantity of the first digital assetinto a corresponding quantity of the second digital asset based upon theexchange rate.

In some instances, the agreed-upon exchange rate, along with additionalparameters of the incentive campaign and eligibility rules for thatincentive campaign, may be maintained locally by one or more computingsystems associated with each of the first and second loyalty programs,which may provision incentive campaign data that includes theagreed-upon exchange rate and selected portions of the campaignparameters and the eligibility rules to computing devices withinenvironment 100 that are operated by the members of the first and secondloyalty programs. For example, program system 140 associated with thefirst loyalty program (e.g., the loyalty program associated with thefinancial institution) may maintain the incentive campaign data within aportion of the one or more tangible, non-transitory memories of programsystem 140, e.g., within campaign data store 144 of data repository 141,and may transmit all or a selected portion of the locally maintainedincentive campaign data across network 120 to one or more computingdevices operated by members of the first loyalty program, such as clientdevice 102 operated by user 101 or client device 122 operated by user121.

By way of example, a wallet application executed by client device 102,such as executed wallet application 104, may receive the transmittedportion of the incentive campaign data from program system 140 (e.g.,via a corresponding programmatic interface, such as API 214 of FIG. 2A),and executed wallet application 104 may perform operations that presentinterface elements representative of the received portion of theincentive campaign data within a corresponding digital interface, e.g.,within an additional display screen of P2P transaction interface 1100.For instance, the additional display screen may prompt user 101 toexchange a specified quantity of the first digital asset allocated bythe first loyalty program (e.g., the units of the first digital coindescribed herein) for a corresponding quantity of the second digitalasset (e.g., units of a second digital coin) allocated by the secondloyalty program in accordance with the exchange rate, or may prompt user101 to transfer the specified quantity of the first digital asset to anadditional member of the second loyalty program, e.g., based on aconversion of the specified quantity of the first digital asset into thecorresponding quantity of the second digital asset based upon theexchange rate.

Although not illustrated in FIG. 11A or 11B, user 101 may provideadditional input to client device 102, e.g., via input unit 222, thatspecifies the quantity of the first digital asset (e.g., 100 units ofthe first digital coin) subject to transfer or exchange, and thatspecifies a public cryptographic key (or other member-specific data) theuniquely identifies user 101 or the additional member duringinteractions with computing systems associated with the second loyaltyprogram, and further, that requests an initiation of the exchange ortransfer based on the specified input (e.g., and may be indicative of aselection of a corresponding “SUBMIT” icon). As described herein, inputunit 222 may provide input data representative of the received input toone or more program modules of executed wallet application 104, such astransaction engine 1116 of executed wallet application 104.

In some instances, also not illustrated in FIG. 11A or 11B, transactionengine 1116 may receive the input data, and may parse the received inputdata to detect the requested initiation of the P2P exchange (e.g., theexchange of the specified quantity of the first digital asset for thecorresponding quantity of the second digital asset by the common memberof the first and second loyalty programs, such as user 101) or the P2Ptransaction (e.g., the transfer of the specified quantity of the firstdigital asset from user 101 to the additional member of the secondloyalty program in accordance with the exchange rate), and to extract,from the input data, information that includes the specified quantity ofthe first digital asset and the public cryptographic key associated withthe member of the second loyalty program. In some examples, executedwallet application 104 may perform any of the exemplary processesdescribed herein to confirm that a current balance of the digital assetheld by user 101 is equivalent to, or exceeds the specified quantity ofthe digital asset subject to exchange or transfer. When the currentbalance is equivalent to, or exceeds the specified quantity of thedigital asset, executed wallet application 104 may perform any of theexemplary processes described herein to generate a digitally signedtransaction request (e.g., transaction request 1200 of FIGS. 12A-12C)based on portions of the extracted information, and to transmit thedigitally signed transaction request across network 120 to wallet system130.

Referring to FIG. 12A, a secure, programmatic interface established andmaintained by wallet system 130, such as API 1127, may receivetransaction request 1200, a first digital signature 1202, and in someinstances, public key certificate 528 of client device 102 (whichincludes public cryptographic key 518), and may programmatically triggeran execution of transaction engine 1132 by the one or more processors ofwallet system 130. In some examples, transaction request 1200 mayinclude, among other things, public cryptographic key 518 (e.g., whichidentifies the member of the first loyalty program that initiated thedesired P2P exchange or transfer) and counterparty data 1206, whichincludes the public cryptographic key of the member of the secondloyalty program (e.g., as specified by user 101 using and of theexemplary processes described herein). Further, as illustrated in FIG.12A, transaction request 1200 may also include transaction parameterdata 1208, such as, but not limited to, asset information 1209 thatidentifies the quantity of the first digital asset subset to P2Pexchange or transfer and rate information 1210 that identifies exchangerate 1212 associated with the requested P2P exchange or transfer.

In some instances, each of public cryptographic key 518 and the publiccryptographic key associated with the member of the second loyaltyprogram (e.g., as specified within counterparty data 1206) may becharacterized by a common structure, format, or composition. Forexample, and for the exemplary P2P exchanges described herein, each ofpublic cryptographic key 518 and the public cryptographic key specifiedwithin counterparty data 1206 may be associated with, and uniquelyidentify user 101 (e.g., public cryptographic key 518 may identify user101 within the first loyalty program associated with the financialinstitution, and the public cryptographic key specified withincounterparty data 1206 may identify user 101 within the second loyaltyprogram, such as the air miles reward program). In other instances,public cryptographic key 518 and the public cryptographic key associatedwith the member of the second loyalty program (e.g., as specified withincounterparty data 1206) may be characterized by a differing andprogram-specific structures, formats, or compositions, and in someexamples, public cryptographic key 518 may identify user 101 within thefirst loyalty program, and the public cryptographic key specified withincounterparty data 1206 may identify and additional, unrelated member ofthe second loyalty program (e.g., the counterparty that receives thecorresponding quantity of the second digital asset subject to conversionfrom the specified quantity first digital asset via the requested P2Ptransaction).

Transaction request 1200 may also include a digital token 1214, a codechallenge 1216, device identifier 506 (e.g., that identifies clientdevice 102) and/or application cryptogram 508 (e.g., that uniquelyidentifies executed wallet application 104). As described herein,digital token 1214 may be generated by wallet system 130 in response toa successful outcome of the exemplary authentication processes describedherein, as implemented collectively by executed wallet application 104and wallet system 130. Digital token 1214 may, for example, correspondto a one-time-use (OTU) token, and may be characterized by apredetermined composition, length, or format. Further, code challenge1216 may be generated by gateway system 160 using any of the exemplaryprocesses described herein, and may correspond to a hash valuerepresentative of all or a selected portion of device identifier 506and/or application cryptogram 508, or may correspond to a hash valuerepresentative of a plaintext cipher maintained confidentially bygateway system 160. Further, although not illustrated in FIG. 12A,transaction engine 1116 executed by client device 102 may also apply adigital signature to code challenge 1216 prior to packaging codechallenge 1216 into a corresponding portion of transaction request 1200.

In some instances, also not illustrated in FIG. 12A, transaction engine1116 of executed wallet application 104 may also perform any of theexemplary processes described herein to apply a first digital signature1202 to transaction request 1200 using private cryptographic key 520 ofexecuted wallet application 104. As described herein, the application offirst digital signature 1202 to transaction request 1200 may beindicative of an approval of, and a consent to, the requested P2Pexchange or transfer by user 101 and/or executed wallet application 104.Further, certain of the exemplary process described herein, which couplethe application of first digital signature 1130 to transaction request1200 to a level or type of consent granted wallet system 130 and/orgateway system 160 by user 101 to access, manipulate, or storeconfidential data, may be implemented in addition to, or as an alternateto, existing token-based authorization and consent protocols (e.g., anOAuth protocol, etc.) during the asset-allocation processes implementedcollectively by client device 102, wallet system 130, and gateway system160.

Referring back to FIG. 12A, application programming interface (API) 1127may route transaction request 1200, a first digital signature 1202, andpublic key certificate 528 (which includes public cryptographic key 518of client device 102) to verification module 1134 of executedtransaction engine 1132. In some instances, verification module 1134 mayparse public key certificate 528 and obtain a public cryptographic keyassociated client device 102 (e.g., public cryptographic key 518 ofexecuted wallet application 104), and perform operations that verifyfirst digital signature 1202 based on the obtained public cryptographickey. If, for example, verification module 1134 were unable to verifyfirst digital signature 1202, verification module 1134 may establishthat transaction request 1200 was either corrupted during transmissionof altered one or more third parties without permission, and executedtransaction engine 1132 may decline the requested P2P exchange ortransfer. In some instances (not illustrated in FIG. 12A), executedtransaction engine 1132 may generate and transmit an error messageacross network 120 to client device 102, e.g., for presentation within acorresponding digital interface.

Alternatively, if verification module 1134 were to verify first digitalsignature 1202, verification module 1134 may perform operations thatobtain device identifier 506, application cryptogram 508, and digitaltoken 1214 from transaction request 1200, and may identify one or moredata records 1215 within credential data store 132 that include orreference device identifier 506 or application cryptogram 508, and assuch, are associated with client device 102 or executed walletapplication 104. As illustrated in FIG. 12A, verification module 1134may obtain, from data records 1215, a local digital token 1218, which isindicative of a currently valid authentication of the identity of user101, and perform operations that determine whether digital token 1214(e.g., as received from client device 102) is consistent with, andcorresponds to, local digital token 1218. If, for example, verificationmodule 1134 were to detect an inconsistency between digital token 1214and local digital token 1218, executed transaction engine 1132 maydecline the requested P2P exchange or transfer and may generate an errormessage, which wallet system 130 may transmit across network 120 toclient device 102.

In other instances, based on the verification of first digital signature1202, and based on the determined consistency between digital token 1214and local digital token 1217, verification module 1134 may performadditional operations that establish a consistency between the exchangerate specified within transaction request 1200 and a current and validasset exchange rate agreed upon by the first and second loyaltyprograms, e.g., the loyalty program associated with the financialinstitution and air miles reward program. For example, verificationmodule 1134 may access rate information 1210 (e.g., as maintained withintransaction request 1200), and obtain exchange rate 1212 associated withthe requested P2P exchange or transfer. Further, verification module1134 may also obtain, from the one or more tangible, non-transitorymemories of gateway system 160, current rate information 1220 thatspecifies a currently valid exchange rate for the conversion of a unitof the first digital asset to a corresponding unit or fraction of thesecond digital asset, e.g., as agreed upon by the first and secondloyalty programs. In some instances, not illustrated in FIG. 12A,verification module 1134 may request, and receive all or a portion ofcurrent rate information 1220 from program system 140, e.g., acrossnetwork 120 through a secure, programmatic interface.

If, for example, verification module 1134 were to detect aninconsistency between exchange rate 1212 (e.g., as received from clientdevice 102) and the currently valid exchange rate, verification module1134 may determine that user 101 and first and second loyalty programsattest to different exchange rates for the requested P2P exchange ortransfer, and executed transaction engine 1132 may decline the requestedP2P exchange or transfer. In some instances (not illustrated in FIG.12A), executed transaction engine 1132 may generate an error messageindicative of the inconsistency in the exchange rate for the requestedP2P exchange or transfer, and wallet system 130 may transmit thegenerated error message across network 120 to client device 102, e.g.,for presentation within a corresponding digital interface. Although notillustrated in FIG. 12, the presented error message may prompt user 101to accept or decline the currently valid exchange rate for the requestedP2P exchange or transfer.

In other examples, if verification module 1134 were to establish aconsistency between exchange rate 1212 (e.g., as received from clientdevice 102) and the currently valid exchange rate (e.g., as agreed uponby the first and second loyalty programs), verification module 1134 maydetermine that user 101 and first and second loyalty programs eachattest to a common exchange rate for the requested P2P exchange ortransfer, and executed transaction engine 1132 may approve the requestedP2P exchange or transfer. Further, and based on the approval of therequested P2P exchange or transfer, verification module 1134 may providetransaction request 1200, first digital signature 1202, and in someinstances, public key certificate 528 and as input to a consent module1138 of executed transaction engine 1132.

Consent module 1138 may, in some examples, perform any of the exemplaryprocesses described herein to apply a second digital signature 1222 totransaction request 1200 and to first digital signature 1202, e.g.,using private cryptographic key 322 of wallet system 130, as maintainedwithin cryptographic data store 134. As described herein, theapplication of second digital signature 1222 to transaction request 1200and to first digital signature 1202 may indicative of an approval of,and a consent to, the requested P2P exchange or transfer by walletsystem 130, and further, a determination by wallet system 130 that user101 and each of the first and second loyalty programs attest to a commonexchange rate for the requested P2P exchange or transfer.

Based on the application of second digital signature 1222 to transactionrequest 1200 and to first digital signature 1202, executed transactionengine 1132 may perform operations that identify a network address ofone or more computing systems associated with the second loyalty program(e.g., the air miles rewards program) within environment 100, such as,but not limited to, an additional wallet system 1230 configured toprovision one or more additional executable wallet applications tocomputing devices operated by the member of the second loyalty program(e.g., client device 102, etc.). Executed transaction engine 1132 mayperform operations that cause wallet system 130 to transmit transactionrequest 1200, first digital signature 1202, second digital signature1222, public key certificate 528 of client device 102 (e.g., thatincludes public cryptographic key 518) and public key certificate 326(e.g., that includes public cryptographic key 320 of wallet system 130)across network 120 to the identified network address of wallet system1230.

In some examples, wallet system 1230 may represent a computing systemthat includes one or more servers and tangible, non-transitory memorydevices storing executable code and application modules. The one or moreservers may each include one or more processors or processor-basedcomputing devices, and the one or more processors or processor-basedcomputing devices may be configured to execute portions of the storedcode or application modules (e.g., such as, but not limited to, theexecutable application programs, program modules, or elements of codedescribed herein in reference to wallet system 130) to performoperations consistent with the disclosed embodiments. In some examples,wallet system 1230 may include a communications unit or interfacecoupled to the one or more processors for accommodating wired orwireless communication across network 120 with any of the additionalnetwork-connected systems or devices described herein, e.g., atransceiver device. Further, and to perform any of the exemplaryprocesses described herein, wallet system 1230 may maintain, within theone or more tangible, non-transitory memories, a data repository 1231that maintains locally one or more of the exemplary elements ofcredential or cryptographic data described herein in reference to walletsystem 130.

Referring back to FIG. 12A, a secure, programmatic interface establishedand maintained by additional wallet system 1230, such as applicationprogramming interface (API) 1235, may receive transaction request 1200,first digital signature 1202, second digital signature 1222, public keycertificate 528 of client device 102 (e.g., that includes publiccryptographic key 518) and public key certificate 326 (e.g., thatincludes public cryptographic key 320 of wallet system 130), and mayperform operations that trigger an execution of a transaction engine1236 by the one or more processors of wallet system 1230. In someexamples, executed transaction engine 1236 may parse public keycertificate 528 to extract public cryptographic key 518 of executedwallet application 104, and may parse public key certificate 326 toextract public cryptographic key 320 of wallet system 130. Executedtransaction engine 1236 may also perform any of the exemplary processesdescribed herein to validate second digital signature 1222 (e.g., asapplied to transaction request 1200 and first digital signature 1202)using public cryptographic key 320 and further, that validate firstdigital signature 1202 (e.g., as applied to transaction request 1200)using public cryptographic key 518.

If, for example, executed additional transaction engine 1236 were unableto verify first digital signature 1202, and additionally, oralternatively, second digital signature 1222, executed transactionengine 1236 may decline the requested P2P exchange or transfer, and maydiscard transaction request 1200. In some instances (not illustrated inFIG. 12A), executed transaction engine 1236 may generate and transmit anerror message across network 120 to wallet system 130, which may routethe error message back to client device 102, e.g., for presentationwithin the corresponding digital interface.

Alternatively, if executed transaction engine 1236 were to verify firstdigital signature 1202 and second digital signature 1222, executedtransaction engine 1236 may perform any of the exemplary processesdescribed herein to establish a further consistency between the exchangerate specified within transaction request 1200 (e.g., exchange rate 1212within rate information 1210) and a current and valid asset exchangerate agreed upon by the first and second loyalty programs, e.g., theloyalty program associated with the financial institution and air milesreward program. If, for example, executed transaction engine 1236 wereto detect an inconsistency between exchange rate 1212 (e.g., as receivedfrom client device 102) and the currently valid exchange rate, executedtransaction engine 1236 may determine that user 101 and first and secondloyalty programs attest to different exchange rates for the requestedP2P exchange or transfer, and executed additional transaction engine1236 may decline the requested P2P exchange or transfer. In someinstances (not illustrated in FIG. 12A), executed transaction engine1236 may generate an error message indicative of the inconsistency inthe exchange rate for the requested P2P exchange or transfer, and walletsystem 1230 may transmit the generated error message across network 120to wallet system 130, which may route the error message back to clientdevice 102, e.g., for presentation within a corresponding digitalinterface. Although not illustrated in FIG. 12A, the presented errormessage may prompt user 101 to accept or decline the currently validexchange rate for the requested P2P exchange or transfer.

In other examples, if executed transaction engine 1236 were to establisha consistency between exchange rate 1212 (e.g., as received from clientdevice 102) and the currently valid exchange rate (e.g., as agreed uponby the first and second loyalty programs), executed additionaltransaction engine 1236 may determine that user 101 and first and secondloyalty programs each attest to a common exchange rate for the requestedP2P exchange or transfer, and executed additional transaction engine1236 may approve the requested P2P exchange or transfer. Further, andbased on the approval of the requested P2P exchange or transfer,executed additional transaction engine 1236 may perform operations thatapply a third digital signature 1238 to transaction request 1200, firstdigital signature 1202, and second digital signature 1222 using aprivate cryptographic key 1240 of wallet system 1230, e.g., asmaintained within data repository 1231.

In some instances, the application of third digital signature 1238 totransaction request 1200, first digital signature 1202, and seconddigital signature 1222 may indicative of an approval of, and a consentto, the requested P2P exchange or transfer by wallet system 1230 andfurther, a determination by wallet system 1230 that user 101 and each ofthe first and second loyalty programs attest to a common exchange ratefor the requested P2P exchange or transfer. Further, and based on theapplication of third digital signature 1238 to transaction request 1200,first digital signature 1202, and second digital signature 1222,executed transaction engine 1236 may perform operations that causewallet system 1230 to transmit transaction request 1200, first digitalsignature 1202, second digital signature 1222, third digital signature1238, public key certificates 326 and 528, and a public key certificate1242 (e.g., that includes a public cryptographic key 1244 of additionalwallet system 1230) across network 120 to wallet system 130.

Further, executed transaction engine 1236 may also perform operationsthat identify a network address of one or more additional computingsystems associated with the second loyalty program (e.g., the air milesrewards program) within environment 100, such as, but not limited to, anadditional gateway system 1260. In some instances, executed transactionengine 1236 may perform operations that cause wallet system 1230 totransmit transaction request 1200, first digital signature 1202, seconddigital signature 1222, third digital signature 1238, and public keycertificate 326, 528, and 1242 back across network 120 to gateway system1260 associated with the second loyalty system.

In some examples, gateway system 1260 may represent a computing systemthat includes one or more servers and tangible, non-transitory memorydevices storing executable code and application modules. The one or moreservers may each include one or more processors or processor-basedcomputing devices, and the one or more processors or processor-basedcomputing devices may be configured to execute portions of the storedcode or application modules (e.g., such as, but not limited to, theexecutable application programs, program modules, or elements of codedescribed herein in reference to wallet system 130) to performoperations consistent with the disclosed embodiments. In some examples,gateway system 1260 may include a communications unit or interfacecoupled to the one or more processors for accommodating wired orwireless communication across network 120 with any of the additionalnetwork-connected systems or devices described herein, e.g., atransceiver device.

Further, and to perform any of the exemplary processes described herein,gateway system 1260 may maintain, within the one or more tangible,non-transitory memories, a data repository 1261 that maintains locallyone or more of the exemplary elements of credential, cryptographic,campaign, or rules data described herein in reference to wallet system130. In some instances, gateway system 1260 may form a portion of apermissioned, distributed-ledger network associated with the secondloyalty program (e.g., the air miles rewards program), and gatewaysystem 1260 may maintain a local version of distributed ledger 1290within a corresponding tangible, non-transitory memory (e.g., withindata repository 1261 of gateway system 1260.

In some instances, a secure, programmatic interface established andmaintained by wallet system 130, such as API 1127, may receive and routetransaction request 1200, first digital signature 1202, second digitalsignature 1222, and third digital signature 1238, and public keycertificates 326, 528, and 1242 to executed transaction engine 1132. Insome instances, executed transaction engine 1132 may perform additionaloperations that cause wallet system 130 to transmit, across network 120to gateway system 160, each of transaction request 1200, first, second,and third signatures 1202, 1222, and 1238, and public key certificates326, 528, and 1242, e.g., using any appropriate communications protocol.

Referring to FIG. 12B, a programmatic interface established andmaintained by gateway system 160, such as API 328, may receivetransaction request 1200, first, second, and third digital signatures1202, 1222, and 1238, and public key certificates 326, 528, and 1242from wallet system 130, and may perform operations that trigger anexecution of verification engine 330 by the one or more processors ofgateway system 160 (e.g., based on one or more programmaticallygenerated commands). In some instances, executed verification engine 330may parse public key certificate 528 to extract public cryptographic key518 of executed wallet application 104, may parse public key certificate326 to extract public cryptographic key 320 of wallet system 130, andmay parse public key certificate 1242 to extract public cryptographickey 1244 of wallet system 1230, e.g., associated with the second loyaltyprogram. Executed verification engine 330 may perform any of theexemplary processes described herein to validate third digital signature1238 (e.g., as applied to transaction request 1200, first digitalsignature 1202, and second digital signature 1222) using publiccryptographic key 1244, to validate second digital signature 1222 (e.g.,as applied to transaction request 1200 and first digital signature 1202)using public cryptographic key 320, and further, to validate firstdigital signature 1202 (e.g., as applied to transaction request 1200)using public cryptographic key 518.

If, for example, executed verification engine 330 were unable to verifyfirst digital signature 1202, second digital signature 1222, andadditionally, or alternatively, third digital signature 1238, executedverification engine 330 may decline the requested P2P exchange ortransfer, and may discard transaction request 1200. In some instances(not illustrated in FIG. 12B), executed verification engine 330 maygenerate an error message indicative of the declined P2P exchange ortransfer, and gateway system 160 may transmit the generated errormessage across network 120 to client device 102 via wallet system 130,e.g., for presentation within the corresponding digital interface.

Alternatively, if executed verification engine 330 were to verify first,second, and third digital signatures 1202, 1222, and 1238, executedverification engine 330 may perform operations that obtain, fromtransaction request 1200, code challenge 1216, device identifier 506,and/or application cryptogram 508. In some examples, executedverification engine 330 may access credential data store 162, andidentify one or more data records 1246 that include or reference deviceidentifier 506 or application cryptogram 508, and as such, as associatedwith client device 102 or executed wallet application 104. Asillustrated in FIG. 12B, executed verification engine 330 may obtain,from data records 1246, a local code challenge 1248 (e.g., generatedusing any of the exemplary processes described herein), and performoperations that determine whether code challenge 1216 (e.g., as receivedfrom client device 102) is consistent with, and corresponds to, localcode challenge 1248.

As described herein, code challenge 1216 may also be associated with anadditional digital signature applied to code challenge 1216 by executedwallet application 104 using private cryptographic key 520. In someinstances, not illustrated in FIG. 12B, executed verification engine 330may perform any of the exemplary processes described herein to validatethe additional digital signature applied to code challenge 1216 prior todetermining the consistency and correspondence between code challenge1216 and local code challenge 1248.

If, for example, executed verification engine 330 were to detect aninconsistency between code challenge 1216 and local code challenge 1248(and in some instances, were unable to validate the additional digitalsignature applied to code challenge 1216), executed verification engine330 may decline the requested P2P transaction or exchange, and maydiscard transaction request 1200. In some instances (not illustrated inFIG. 12B), executed verification engine 330 may perform any of theexemplary processes described herein to generate and transmit acorresponding error message across network 120 to client device 102 viawallet system 130, e.g., for presentation within the correspondingdigital interface. Alternatively, based on the validation of first,second, and third digital signatures 1202, 1222, and 1238 (and in someinstances, the validation of the additional digital signature applied tocode challenge 1216), and based on the determined consistency betweencode challenge 1216 and local code challenge 1248, executed verificationengine 330 may approve the requested P2P transaction or exchange.

As illustrated in FIG. 12B, executed verification engine 330 may provideapproved transaction request 1200 as an input to a distributedtransaction engine 1146, which may be executed by the one or moreprocessors of gateway system 160. In some instances, executeddistributed transaction engine 1146 may perform operations that obtain,from transaction request 1200, public cryptographic key 518 of executedwallet application 104 and asset information 1209 that identifies thequantity of the first digital asset subset to transfer or exchange(e.g., as maintained within transaction parameter data 1208 oftransaction request 1200). Further, although not illustrated in FIG.12B, executed distributed transaction engine 1146 may perform operationsthat store public cryptographic key 518 and asset information 1209within one or more of the tangible, non-transitory memories of gatewaysystem 160, e.g., within a portion of data repository 161, and mayperform any of the exemplary processes described herein to verify thatthe requested P2P exchange or transfer complies with any of theexemplary P2P transaction rules described herein, or to apply any of theexemplary fraud detection or mitigation processes described herein tothe P2P exchange or transfer.

In some instances, executed distributed transaction engine 1146 maygenerate debit data 1250 that identifies the quantity of the firstdigital asset subject to exchange or transfer through the P2P exchangeor transfer (e.g., the 100 units of the first digital coin), asspecified within asset information 1209, and may perform operations thatpackage public cryptographic key 518 and debit data 1250 intocorresponding portion of a first transaction object 1252. As describedherein, when recorded onto one or more additional elements ofdistributed ledger 1168, first transaction object 1252 may debit thespecified first quantity of the digital asset (e.g., as maintainedwithin debit data 1250) from the current balance of the digital assetheld by user 101.

In some examples, executed distributed transaction engine 1146 and mayalso apply a digital signature 1253 to first transaction object 1252using private cryptographic key 342 of gateway system 160, e.g., asmaintained within cryptographic data store 164. Further, executeddistributed transaction engine 1146 may perform additional operationsthat cause gateway system 160 to broadcast first transaction object1252, applied digital signature 1253, and public key certificate 344(that includes public cryptographic key 346 of gateway system 160)across network 120 to one or more of node systems 180, such as nodesystem 182 (e.g., through a secure, programmatic interface, such as API348 of node system 182).

In some examples, each of the one or more of node systems 180, includingnode system 182, may perform any of the exemplary, consensus-basedoperations described herein to: (i) verify digital signature 1253 usingpublic cryptographic key 346 (e.g., as obtained from public keycertificate 344); and (ii) generate an additional element 1254 ofdistributed ledger 1168 that includes, among other things, firsttransaction object 1252 (e.g., which itself includes publiccryptographic key 518 of executed wallet application 104 and debit data1250), a digital signature 1255 applied to first transaction object 1252(e.g., using a private cryptographic key of corresponding ones of nodesystems 180, including node system 182), a hash value 1256representative of first transaction object 1252 and digital signature1255 (and in some instances, to other elements of distributed ledger1168), and an identifier 1254A (e.g., a “block number”) that specifies asequential position of additional element 1254 in relation to theexisting, prior elements of distributed ledger 1168. The one or more ofnode systems 180, including node system 182, may also perform operationsthat append additional element 1254 to distributed ledger 1168 togenerate an updated distributed ledger, e.g., distributed ledger 1258.

Further, and based on a successful completion of these exemplaryconsensus-based processes (e.g., the calculation of an appropriateproof-of-work or proof-of-stake, as described herein) prior to otherones of node systems 180, node system 182 may broadcast distributedledger 1258, which represents the latest, longest version of thedistributed ledger, to the additional ones of node systems 180 operatingwithin environment 100 and additionally or alternatively, to each of thenetwork-connected systems that participate in the permissioned,distributed-ledger network described herein, such as gateway system 160.As described herein, the recordation of first transaction object 1252within element 1254 of distributed ledger 1258 may debit the specifiedquantity of the first digital asset, e.g., the one hundred digitalcoins, from the current balance of the digital asset held by user 101,as tracked by the elements of distributed ledger 1258.

In some instances, gateway system 160 may receive updated distributedledger 1258, and executed distributed transaction engine 1146 of gatewaysystem 160 may store distributed ledger 1258 within a portion of the oneor more tangible, non-transitory memories, such as data repository 161(e.g., to replace distributed ledger 1168). Executed distributedtransaction engine 1146 may also perform operations that, based on thereceipt of distributed ledger 1258 and the recordation of firsttransaction object 1252 within element 1254, generate a confirmationmessage (not illustrated in FIG. 12B) that confirms the debit of thespecified quantity of the digital asset, e.g., the one hundred digitalcoins, from the current balance of the digital asset held by user 101,and the successful transfer of the specified quantity of the digitalasset to the counterparty associated with the requested P2P exchange ortransfer, e.g., the member of the second loyalty program. Further,executed distributed transaction engine 1146 may perform operations thatcause gateway system 160 to transmit the confirmation message acrossnetwork 120 to client device 102, e.g., via wallet system 130.

Referring to FIG. 12C, a programmatic interface established andmaintained by gateway system 1260, such as API 1260A, may receivetransaction request 1200, first, second, and third digital signatures1202, 1222, and 1238, and public key certificates 326, 528, and 1242from wallet system 130, and may perform operations that trigger anexecution of a verification engine 1262 by the one or more processors ofgateway system 1260. In some instances, executed verification engine1262 may parse public key certificate 528 to extract publiccryptographic key 518 of executed wallet application 104, may parsepublic key certificate 326 to extract public cryptographic key 320 ofwallet system 130, and may parse public key certificate 1242 to extractpublic cryptographic key 1244 of wallet system 1230, e.g., associatedwith the second loyalty program. Executed verification engine 1262 mayperform any of the exemplary processes described herein to validatethird digital signature 1238 (e.g., as applied to transaction request1200, first digital signature 1202, and second digital signature 1222)using public cryptographic key 1244, to validate second digitalsignature 1222 (e.g., as applied to transaction request 1200 and firstdigital signature 1202) using public cryptographic key 320, and further,to validate first digital signature 1202 (e.g., as applied totransaction request 1200) using public cryptographic key 518.

If, for example, executed verification engine 1262 were unable to verifyfirst digital signature 1202, second digital signature 1222, andadditionally, or alternatively, third digital signature 1238, executedverification engine 1262 may decline the requested P2P exchange ortransfer, and may discard transaction request 1200. In some instances(not illustrated in FIG. 12C), executed verification engine 1262 maygenerate an error message indicative of the declined P2P exchange ortransfer, and gateway system 1260 may transmit the generated errormessage across network 120 to wallet system 1230.

Alternatively, if executed verification engine 1262 were to verify firstdigital signature 1202, second digital signature 1222, and third digitalsignature 1238, executed verification engine 1262 may approve therequested P2P transaction or exchange, and may provide approvedtransaction request 1200 as an input to a distributed transaction engine1264, which may be executed by the one or more processors of gatewaysystem 1260. In some instances, executed distributed transaction engine1264 may perform operations that obtain, from transaction request 1200,counterparty data 1206, which includes the public cryptographic key 1265of the member of the second loyalty program (e.g., as specified by user101 using and of the exemplary processes described herein) andtransaction parameter data 1208, which may include asset information1209 that identifies the quantity of the first digital asset subset totransfer or exchange and rate information 1210 that identifies theexchange rate 1212 associated with the requested P2P exchange ortransfer. Further, although not illustrated in FIG. 12C, executeddistributed transaction engine 1264 may perform operations that storepublic cryptographic key 1265 and transaction parameter data 1208 withinone or more of the tangible, non-transitory memories of gateway system1260, e.g., within a portion of data repository 1261.

In some instances, executed distributed transaction engine 1264 mayperform operations that, based on exchange rate 1212, convert thespecified quantity of the first digital asset (e.g., as specified withinasset information 1209) into the corresponding quantity of the seconddigital asset associated with the second loyalty program. By way ofexample, the specified quantity of the first digital asset may includeone hundred units of a first digital coin, and exchange rate 1212 mayspecify that a single unit of the first digital asset corresponds 1.37units of the second digital asset (e.g., a second digital coin allocatedby the second loyalty program), and executed distributed transactionengine 1146 may perform operations that convert the one hundred units ofthe first digital coins into a corresponding 1.37 units of the seconddigital coin allocated by the second loyalty program. Executeddistributed transaction engine 1146 may also generate credit data 1266that identifies the converted, corresponding quantity of the seconddigital asset (e.g., the 1.37 units of second digital coin), and mayperform operations that package public cryptographic key 1265 and creditdata 1266 into corresponding portion of a second transaction object1268. As described herein, when recorded onto one or more additionalelements of distributed ledger 1290, second transaction object 1268 maydebit the corresponding quantity of the second digital assets (e.g., the1.37 units of second digital coin maintained within credit data 1266) tothe current balance of the digital asset held by user 101, e.g., throughthe executed P2P exchange or transfer.

In some examples, executed distributed transaction engine 1264 may alsoapply a digital signature 1270 to second transaction object 1268 using aprivate cryptographic key 1272 of gateway system 1260 (e.g., asmaintained within data repository 1261). Further, executed distributedtransaction engine 1264 may perform additional operations that causegateway system 1260 to broadcast second transaction object 1268, applieddigital signature 1270, and public key certificate 1274 (that includespublic cryptographic key 1276 of gateway system 1260) across network 120to one or more of node systems 1280, such as node system 1282 (e.g.,through a secure, programmatic interface, such as applicationprogramming interface (API) 1282A of node system 1282).

Each of node systems 1280, including node system 1282, may represent acomputing system that includes one or more servers and tangible,non-transitory memory devices storing executable code and applicationmodules. The one or more servers may each include one or more processorsor processor-based computing devices, and the one or more processors orprocessor-based computing devices may be configured to execute portionsof the stored code or application modules (e.g., such as, but notlimited to, the executable application programs, program modules, orelements of code described herein in reference to wallet system 130) toperform operations consistent with the disclosed embodiments. In someexamples, each of node systems 1280, including node system 1282, mayinclude a communications unit or interface coupled to the one or moreprocessors for accommodating wired or wireless communication acrossnetwork 120 with any of the additional network-connected systems ordevices described herein, e.g., a transceiver device.

In some examples, each of the one or more of node systems 1280,including node system 1282, may execute a block generation module (e.g.,block generation module 1283) that performs any of the exemplary,consensus-based operations described herein to: (i) verify digitalsignature 1270 using public cryptographic key 1276 (e.g., as obtainedfrom public key certificate 1274); and (ii) generate an additionalelement 1284 of a distributed ledger (e.g., as maintained by nodesystems 1280) that includes, among other things, second transactionobject 1268 (e.g., which itself includes public cryptographic key 1265of member of the second loyalty program and credit data 1266), a digitalsignature 1285 applied to second transaction object 1268 (e.g., using aprivate cryptographic key of corresponding ones of node systems 180,including node system 182), a hash value 1286 representative of secondtransaction object 1268 and digital signature 1285 (and in someinstances, to other elements of distributed ledger 1290), and anidentifier 1284A (e.g., a “block number”) that specifies a sequentialposition of additional element 1284 in relation to the existing, priorelements of distributed ledger 1290. The one or more of node systems1280, including node system 1282, may also perform operations thatappend additional element 1284 to the prior distributed ledger togenerate an updated distributed ledger, e.g., distributed ledger 1290that includes smart contract elements 1292 and additional element 1284.

Further, and based on a successful completion of these exemplaryconsensus-based processes (e.g., the calculation of an appropriateproof-of-work or proof-of-stake, as described herein) prior to otherones of node systems 1280, node system 1282 may broadcast distributedledger 1290, which represents the latest, longest version of thedistributed ledger, to the additional ones of node systems 1280operating within environment 100 and additionally or alternatively, toeach of the network-connected systems that participate in thepermissioned, distributed-ledger network described herein, such asgateway system 1260. As described herein, the recordation of secondtransaction object 1268 within element 1284 of distributed ledger 1290may credit the corresponding quantity of the second digital asset, e.g.,the 1.37 units of the second digital coin, to the current balance of thesecond digital asset held by the member of the second loyalty program,as tracked by the elements of distributed ledger 1290.

In some instances, gateway system 1260 may receive updated distributedledger 1290, and executed distributed transaction engine 1264 of gatewaysystem 1260 may store distributed ledger 1292 within a portion of theone or more tangible, non-transitory memories, such as data repository1261 (e.g., to replace distributed ledger 1168). Executed distributedtransaction engine 1264 may also perform operations that, based on thereceipt of distributed ledger 1290 and the recordation of secondtransaction object 1268 within element 1284, generate a confirmationmessage (not illustrated in FIG. 12C) that confirms the credit of thecorresponding quantity of the second digital asset, e.g., the 1.37 unitsof the second digital coin, to the current balance of the digital assetheld by the member of the second loyalty program. Further, executeddistributed transaction engine 1264 may perform operations that causegateway system 1260 to transmit the confirmation message across network120 to a device operated by the member of the second loyalty program,e.g., via wallet system 1230.

FIGS. 13A and 13B are flowcharts of exemplary processes for initiatingand managing transfers of digital assets between computing systems usingpermissioned distributed ledgers, in accordance with the disclosedembodiments. In some examples, a computing system capable ofprovisioning and supporting wallet applications executed by computingdevices within the computing environment, such as wallet system 130, mayperform one or more of the exemplary steps of process 1300, as describedbelow in reference to FIG. 13A. Further, a computing system associatedwith permissioned, distributed-ledger network operating within theenvironment, such as gateway system 160, may perform one or more of theexemplary steps of process 1350, as described below in reference to FIG.13B.

Referring to FIG. 13A, wallet system 130 may receive, from a clientdevice (e.g., client device 102 or client device 122 of FIG. 1), atransaction request for a peer-to-peer (P2P) exchange or transactionthat transfers a specified quantity of a digital asset from user of theclient device (e.g., user 101 or user 121 of FIG. 1) to a specifiedcounterparty, and a first digital signature applied to the transactionrequest (e.g., in step 1302). By way of the example, the user of theclient device may correspond to a member of a first loyalty programassociated with a financial institution, and the digital asset may beallocated to the member of the first loyalty program throughparticipation in a qualifying transaction, or through any of theexemplary asset-allocation processes described herein. In some examples,the counterparty may correspond to an additional member of the firstloyalty program, or a member of a second loyalty program (e.g., an airmiles reward program) unrelated to the first loyalty program.

As described herein, the transaction request may be generated by awallet application executed by the client device (e.g., executed walletapplication 104 or executed wallet application 124), and the transactionrequest may include, among other things, a public cryptographic key thatuniquely identifies the executed wallet application, an additionalpublic cryptographic key that uniquely identifies a wallet applicationexecuted by a device operated by the counterparty (e.g., a counterpartydevice), a digital token generated by wallet system 130 in response to asuccessful authentication of an identity of the user (e.g., aone-time-user (OTU) token), and a code challenge generated by gatewaysystem 160. The transaction request may also include transactionparameter data that identifies the specified quantity of the digitalasset subject to transfer through the P2P exchange or transaction, andin some instances, an exchange rate associated with a conversion of thespecified quantity of the digital asset into a corresponding quantity ofan additional digital asset allocated to members of the second loyaltyprogram, e.g., using any of the exemplary processes described herein.

Further, as also described herein, the wallet application executed bythe client device may apply the first digital signature to thedistribution request, e.g., using a corresponding private cryptographickey of the executed wallet application. In some instances, theapplication of the first digital signature to the distribution requestby the executed wallet application may be indicative of an approval ofand consent to the requested distribution registration (e.g., therequested allocation or the requested redemption) by the user of theclient device.

In some instances, wallet system 130 may perform any of the exemplaryprocesses described herein to validate the applied first digitalsignature (e.g., in step 1304). If wallet system 130 were unable toverify the first digital signature, (e.g., step 1304; NO), wallet system130 may decline the requested P2P exchange or transaction (e.g., in step1306). Wallet system 130 may perform any of the exemplary processesdescribed herein to generate and transmit an error message to the clientdevice (e.g., in step 1308). Exemplary process 1300 is then complete instep 1310.

Alternatively, if wallet system 130 were to verify the first digitalsignature (e.g., step 1304; YES), wallet system 130 may parse thetransaction request to extract the digital token (e.g., the OTU token)from the transaction request (e.g., in step 1311), and may perform anyof the exemplary processes described herein to verify the extracteddigital token is consistent with, and corresponds to, a locallymaintained copy of the digital token provisioned to the client device(e.g., in step 1312). If, for example, wallet system 130 were to detectan inconsistency between the extracted digital token and the local copyof the digital token (e.g., step 1312; NO), exemplary process 1300 maypass back to step 1306, and wallet system 130 may decline the requesteddistribution of the digital asset, or of the predetermined quantity ofthe digital asset, e.g., the requested allocation or distributiondescribed herein.

In other examples, if wallet system 130 were to establish a consistency,and a correspondence, between the extracted digital token and thelocally maintained copy of the digital token (e.g., step 1312; YES),wallet system 130 may approve, and consent to, the requested P2Pexchange or transaction (e.g., in step 1314). Further, wallet system 130may perform any of the exemplary processes described herein to apply asecond digital signature to the transaction request and to the firstdigital signature (e.g., in step 1316). As described herein, theapplication of the second digital signature to the transaction requestand to the first digital signature may indicative of an approval of, anda consent to, the requested P2P exchange or transaction by wallet system130.

Wallet system 130 may perform any of the exemplary processes describedherein to establish that the counterparty to the P2P exchange ortransaction represents a member of the first loyalty program and assuch, that a wallet application executed by the client device representsa valid wallet application provisioned by wallet system 130 (e.g., instep 1318). If, for example, wallet system 130 were to establish thatthe counterparty represents a member of the first loyalty program, andthat the counterparty device executed a validly provisioned walletapplication (step 1318; YES), wallet system 130 may transmit thetransaction request, the first digital signature, and the second digitalsignature across network 120 to a computing system that participates inthe permissioned, distributed-ledger network associated with the firstloyalty program, such as gateway system 160 (e.g., in step 1320).Exemplary process 1300 is then complete in step 1310.

Referring back to step 1318, if wallet system 130 were to establish thatthe counterparty does not represent a member of the first loyaltyprogram (step 1318; NO), wallet system 130 may perform any of theexemplary processes described herein to determine that the counterpartyrepresents a member of an additional or alternate loyalty program, suchas the second loyalty program described herein (e.g., in step 1322), andmay perform operations that transmit the transaction request, the firstdigital signature, and the second digital signature across network 120to a computing system associated with the second loyalty program (e.g.,in step 1324). For example, the second loyalty program may correspond toan air miles rewards program, and the computing system associated withthe second loyalty program may correspond to wallet system 1230, whichprovisions and supports wallet applications associated with the secondloyalty program and executed by computing devices within the computingenvironment.

In some instances, wallet system 1230 may perform any of the exemplaryprocesses described herein to validate the first digital signature andthe second digital signature, and to perform any of the exemplaryprocesses described herein to establish a consistency between theexchange rate specified within the transaction request and a currentlyvalid exchange rate established by mutual consensus between the firstand second loyalty programs. Based on the determined validity of thefirst and second digital signatures, and based on the establishedconsistency between the specified and currently valid exchange rates,wallet system 1230 may perform any of the exemplary processes describedherein to apply a third digital signature to the transaction request. Asdescribed herein, the application of the third digital signature to thetransaction request and to the first and second digital signatures mayindicative of an approval of, and a consent to, the requested P2Pexchange or transaction by wallet system 1230, and wallet system 1230may transmit the transaction request and the first, second, and thirddigital signatures back across network 120 to wallet system 130.

Referring back to FIG. 13A, wallet system 130 may receive thetransaction request and the applied first, second, and third digitalsignatures from wallet system 1230, and wallet system 130 may transmitthe transaction request and the applied first, second, and third digitalsignatures to the computing system that participates in thepermissioned, distributed-ledger network associated with the firstloyalty program, such as gateway system 160 (e.g., in step 1326).Exemplary process 1300 is then complete in step 1310.

Referring to FIG. 13B, gateway system 160 may receive the transactionrequest, the first digital signature, and the second digital signaturefrom wallet system 130 (e.g., in step 1352). In some instances, in step1354, gateway system 160 may perform any of the exemplary processesdescribed herein to validate the first digital signature and the seconddigital signature. If gateway system 160 were unable to validate thefirst digital signature or the second digital signature, (e.g., step1354; NO), gateway system 160 may decline the requested peer-to-peer(P2P) exchange or transaction (e.g., in step 1356). Gateway system 160may perform any of the exemplary processes described herein to generatean error message indicative of the declined P2P exchange or transaction,and may transmit the generated error message to the client device viawallet system 130 (e.g., in step 1358). Exemplary process 1350 is thencomplete in step 1360.

Alternatively, if gateway system 160 were to verify both the first andsecond digital signatures (e.g., step 1354; YES), gateway system 160 mayparse the distribution request to extract the code challenge from thetransaction request (e.g., in step 1361), and may perform any of theexemplary processes described herein to verify the extracted codechallenge is consistent with, and corresponds to, a locally maintainedcopy of the code challenge provisioned to the client device (e.g., instep 1362). If, for example, gateway system 160 were to detect aninconsistency between the extracted code challenge and the local copy ofthe code challenge (e.g., step 1362; NO), exemplary process 1350 maypass back to step 1356, and gateway system 160 may decline the requestedP2P exchange or transaction.

Alternatively, if gateway system 160 were to establish a consistency,and a correspondence, between the extracted code challenge and thelocally maintained copy of the code challenge (e.g., step 1362; YES),gateway system 160 may perform any of the exemplary processes describedherein to establish a compliance of the requested P2P exchange ortransaction with one or more transaction-specific rules that imposecorresponding conditions on the requested P2P exchange or transaction(e.g., in step 1364). If, for instance, gateway system 160 were todetect an inconsistency between at least one of the conditions imposedby the one or more transaction-specific rules and requested P2P exchangeor transaction (step 1364; NO), exemplary process 1350 may pass back tostep 1356, and gateway system 160 may decline the requested P2P exchangeor transaction, as described herein. Alternatively, if gateway system160 were to establish a consistency between the conditions imposed bythe one or more transaction-specific rules and requested P2P exchange ortransaction, gateway system 160 may also apply one or more frauddetection and mitigation processes to the now-verified transactionrequest (e.g., in step 1366). By way of example, the applied frauddetection and mitigation processes may include adding data identifyingthe transaction request to a queue of pending requests, which may delaya processing of the P2P exchange or transaction for predetermined ordynamically determined time period.

For example, and upon expiration of the predetermined or dynamicallydetermined time period, gateway system 160 may establish a successfuloutcome of the fraud detection and mitigation processes, and approve,and consent to, the requested P2P exchange or transaction (e.g., in step1368). Gateway system 160 may also perform any of the exemplaryprocesses described herein to generate at least one of a payertransaction object or a payee transaction object associated with thenow-approved P2P exchange or transaction, and to apply any additionaldigital signature to the at least one of the payer transaction object orthe payee transaction object (e.g., in step 1370).

Further, gateway system 160 may also perform any of the exemplaryprocesses described herein, in conjunction with one or more node systemsoperating within the computing environment, to record immutably at leastone of the payer transaction object or the payee transaction object anelement of a cryptographically secure distributed ledger (e.g., in step1372). In some instances, and as described herein, gateway system 160may receive a confirmation message indicative of the recordation of theat least one of the payer transaction object or the payee transactionobject within the element of the distributed ledger, and may route theconfirmation message back to the client device via wallet system 130(e.g., in step 1374). Exemplary process 1350 is then complete in step1360.

Embodiments of the subject matter and the functional operationsdescribed in this specification can be implemented in digital electroniccircuitry, in tangibly-embodied computer software or firmware, incomputer hardware, including the structures disclosed in thisspecification and their structural equivalents, or in combinations ofone or more of them. Exemplary embodiments of the subject matterdescribed in this specification, such as, but not limited to, walletapplications 104 and 124, campaign engine 202, application programminginterfaces (APIs) 214, 234, 238, 260, 278, 310, 328, 348, 502, 623,1127, 1235, 1260A, and 1282A, authentication engine 262, challengeengine 280, registration engine 312, verification module 314, consentmodule 318, verification engine 330, distributed registration engine336, block generation modules 350 and 1283, allocation engine 530,verification module 532, consent module 538, distributed allocationengine 546, redemption engine 602, redemption module 618, distributedquery engine 626, query management engine 634, balance inquiry module636, redemption engine 710, verification module 712, consent module 718,distributed redemption engine 725, triggering module 902, keyregeneration module 906, transaction module 1116, transaction engine1132, verification module 1134, consent module 1138, distributedtransaction engine 1146, transaction engine 1236, verification engine1262, and distributed transaction engine 1264, can be implemented as oneor more computer programs, i.e., one or more modules of computer programinstructions encoded on a tangible non-transitory program carrier forexecution by, or to control the operation of, a data processingapparatus (or a computer system).

Additionally, or alternatively, the program instructions can be encodedon an artificially generated propagated signal, such as amachine-generated electrical, optical, or electromagnetic signal that isgenerated to encode information for transmission to suitable receiverapparatus for execution by a data processing apparatus. The computerstorage medium can be a machine-readable storage device, amachine-readable storage substrate, a random or serial access memorydevice, or a combination of one or more of them.

The terms “apparatus,” “device,” and “system” refer to data processinghardware and encompass all kinds of apparatus, devices, and machines forprocessing data, including, by way of example, a programmable processorsuch as a graphical processing unit (GPU) or central processing unit(CPU), a computer, or multiple processors or computers. The apparatus,device, or system can also be or further include special purpose logiccircuitry, such as an FPGA (field programmable gate array) or an ASIC(application-specific integrated circuit). The apparatus, device, orsystem can optionally include, in addition to hardware, code thatcreates an execution environment for computer programs, such as codethat constitutes processor firmware, a protocol stack, a databasemanagement system, an operating system, or a combination of one or moreof them.

A computer program, which may also be referred to or described as aprogram, software, a software application, a module, a software module,a script, or code, can be written in any form of programming language,including compiled or interpreted languages, or declarative orprocedural languages, and it can be deployed in any form, including as astand-alone program or as a module, component, subroutine, or other unitsuitable for use in a computing environment. A computer program may, butneed not, correspond to a file in a file system. A program can be storedin a portion of a file that holds other programs or data, such as one ormore scripts stored in a markup language document, in a single filededicated to the program in question, or in multiple coordinated files,such as files that store one or more modules, sub-programs, or portionsof code. A computer program can be deployed to be executed on onecomputer or on multiple computers that are located at one site ordistributed across multiple sites and interconnected by a communicationnetwork.

The processes and logic flows described in this specification can beperformed by one or more programmable computers executing one or morecomputer programs to perform functions by operating on input data andgenerating output. The processes and logic flows can also be performedby, and apparatus can also be implemented as, special purpose logiccircuitry, such as an FPGA (field programmable gate array), an ASIC(application-specific integrated circuit), one or more processors, orany other suitable logic.

Computers suitable for the execution of a computer program include, byway of example, general or special purpose microprocessors or both, orany other kind of central processing unit. Generally, a CPU will receiveinstructions and data from a read-only memory or a random-access memoryor both. The essential elements of a computer are a central processingunit for performing or executing instructions and one or more memorydevices for storing instructions and data. Generally, a computer willalso include, or be operatively coupled to receive data from or transferdata to, or both, one or more mass storage devices for storing data,such as magnetic, magneto-optical disks, or optical disks. However, acomputer need not have such devices. Moreover, a computer can beembedded in another device, such as a mobile telephone, a personaldigital assistant (PDA), a mobile audio or video player, a game console,a Global Positioning System (GPS) receiver, or a portable storagedevice, such as a universal serial bus (USB) flash drive.

Computer-readable media suitable for storing computer programinstructions and data include all forms of non-volatile memory, mediaand memory devices, including by way of example semiconductor memorydevices, such as EPROM, EEPROM, and flash memory devices; magneticdisks, such as internal hard disks or removable disks; magneto-opticaldisks; and CD-ROM and DVD-ROM disks. The processor and the memory can besupplemented by, or incorporated in, special purpose logic circuitry.

To provide for interaction with a user, embodiments of the subjectmatter described in this specification can be implemented on a computerhaving a display unit, such as a CRT (cathode ray tube) or LCD (liquidcrystal display) monitor, a TFT display, or an OLED display, fordisplaying information to the user and a keyboard and a pointing device,such as a mouse or a trackball, by which the user can provide input tothe computer. Other kinds of devices can be used to provide forinteraction with a user as well; for example, feedback provided to theuser can be any form of sensory feedback, such as visual feedback,auditory feedback, or tactile feedback; and input from the user can bereceived in any form, including acoustic, speech, or tactile input. Inaddition, a computer can interact with a user by sending documents toand receiving documents from a device that is used by the user; forexample, by sending web pages to a web browser on a user's device inresponse to requests received from the web browser.

Implementations of the subject matter described in this specificationcan be implemented in a computing system that includes a back-endcomponent, such as a data server, or that includes a middlewarecomponent, such as an application server, or that includes a front-endcomponent, such as a computer having a graphical user interface or a Webbrowser through which a user can interact with an implementation of thesubject matter described in this specification, or any combination ofone or more such back-end, middleware, or front-end components. Thecomponents of the system can be interconnected by any form or medium ofdigital data communication, such as a communication network. Examples ofcommunication networks include a local area network (LAN) and a widearea network (WAN), such as the Internet.

The computing system can include clients and servers. A client andserver are generally remote from each other and typically interactthrough a communication network. The relationship of client and serverarises by virtue of computer programs running on the respectivecomputers and having a client-server relationship to each other. In someimplementations, a server transmits data, such as an HTML page, to auser device, such as for purposes of displaying data to and receivinguser input from a user interacting with the user device, which acts as aclient. Data generated at the user device, such as a result of the userinteraction, can be received from the user device at the server.

While this specification includes many specifics, these should not beconstrued as limitations on the scope of the invention or of what may beclaimed, but rather as descriptions of features specific to particularembodiments of the invention. Certain features that are described inthis specification in the context of separate embodiments may also beimplemented in combination in a single embodiment. Conversely, variousfeatures that are described in the context of a single embodiment mayalso be implemented in multiple embodiments separately or in anysuitable sub-combination. Moreover, although features may be describedabove as acting in certain combinations and even initially claimed assuch, one or more features from a claimed combination may in some casesbe excised from the combination, and the claimed combination may bedirected to a sub-combination or variation of a sub-combination.

Similarly, while operations are depicted in the drawings in a particularorder, this should not be understood as requiring that such operationsbe performed in the particular order shown or in sequential order, orthat all illustrated operations be performed, to achieve desirableresults. In certain circumstances, multitasking and parallel processingmay be advantageous. Moreover, the separation of various systemcomponents in the embodiments described above should not be understoodas requiring such separation in all embodiments, and it should beunderstood that the described program components and systems maygenerally be integrated together in a single software product orpackaged into multiple software products.

In this application, the use of the singular includes the plural unlessspecifically stated otherwise. In this application, the use of “or”means “and/or” unless stated otherwise. Furthermore, the use of the term“including,” as well as other forms such as “includes” and “included,”is not limiting. In addition, terms such as “element” or “component”encompass both elements and components comprising one unit, and elementsand components that comprise more than one subunit, unless specificallystated otherwise. The section headings used herein are fororganizational purposes only, and are not to be construed as limitingthe described subject matter.

Various embodiments have been described herein with reference to theaccompanying drawings. It will, however, be evident that variousmodifications and changes may be made thereto, and additionalembodiments may be implemented, without departing from the broader scopeof the disclosed embodiments as set forth in the claims that follow.

Further, other embodiments will be apparent to those skilled in the artfrom consideration of the specification and practice of one or moreembodiments of the present disclosure. It is intended, therefore, thatthis disclosure and the examples herein be considered as exemplary only,with a true scope and spirit of the disclosed embodiments beingindicated by the following listing of exemplary claims.

What is claimed is:
 1. A device, comprising: a communications interface;a memory storing instructions; and at least one processor coupled to thecommunications interface and the memory, the at least one processorbeing configured to execute the instructions to: receive, via thecommunications interface, first confirmation data from a first computingsystem, the first confirmation data being indicative of a recordation ofa first public key of an application program executed by the devicewithin a first element of a distributed ledger, the first public keybeing associated with a first private key maintained within a portion ofthe memory; based on a determined occurrence of a regeneration conditionassociated with the first public key, transmit, via the communicationsinterface to a second computing system, a registration request and afirst digital signature applied to the registration request, theregistration request comprising a second public key of the applicationprogram, and the second computing system being configured to validatethe first digital signature, apply a second digital signature to theregistration request and the first digital signature, and transmit theregistration request, the first digital signature, and the seconddigital signature to the first computing system; receive, via thecommunications interface, second confirmation data from the firstcomputing system, the second confirmation data being indicative of arecordation, within a second element of the distributed ledger, of thesecond public key and pointer data identifying the first element; andbased on the second confirmation data, store a second private keyassociated with the second public key within the portion of the memory,the storage of the second private key invalidating the first privatekey.
 2. The device of claim 1, wherein the at least one processor isfurther configured to: obtain authentication data based on thedetermined occurrence of the regeneration condition, the authenticationdata comprising one or more authentication credentials of a userassociated with the device; transmit, via the communications interface,the authentication data to the second computing system, the secondcomputing system being configured to authenticate the user based on theauthentication data and to generate a digital token indicative of theauthentication of the user; and receive the digital token from thesecond computing system via the communications interface, and store thedigital token and the authentication data within a portion of thememory.
 3. The device of claim 2, wherein the at least one processor isfurther configured to generate the second public key and the secondprivate key in response to the receipt of the digital token from thesecond computing system.
 4. The device of claim 2, wherein the at leastone processor is further configured to: generate and transmit achallenge request to the first computing system via the communicationsinterface, the challenge request comprising at least one of a networkaddress of the device or an application cryptogram of the applicationprogram; receive a challenge code from the first computing system viathe communications interface, the challenge code being generated by thefirst computing system based on the challenge request, and the challengecode comprising a hash value of the at least one of the network addressof the device or the application cryptogram, or a hash value of aplaintext cipher; and store the code challenge in the portion of thememory associated with the digital token.
 5. The device of claim 4,wherein the at least one processor is further configured to generate theregistration request, the registration request comprising the digitaltoken, the code challenge, and at least one of the network address orthe application cryptogram, and the second computing system beingfurther configured to validate the digital token.
 6. The device of claim1, wherein the at least one processor is further configured to apply thefirst digital signature to the registration request using the firstprivate key.
 7. The device of claim 1, wherein: the regenerationcondition comprises a temporal condition associated with the firstpublic key, the temporal condition specifying a temporal period ofvalidity for the first public key; detect an expiration of the temporalperiod of validity, and based on the detected expiration of the temporalperiod of validity, determine the occurrence of the regenerationcondition associated with the first public key.
 8. The device of claim1, wherein the at least one processor is further configured to apply thefirst digital signature to the registration request using the secondprivate key based on the determined occurrence of the regenerationcondition.
 9. The device of claim 1, wherein the pointer data comprisesa positional identifier associated with the first element of thedistributed ledger, the positional identifier specifying the sequentialposition of the first element within the distributed ledger.
 10. Thedevice of claim 9, wherein the pointer data further comprises the firstpublic key of the executed application program.
 11. The device of claim1, wherein the device is operable by a user, the executed applicationprogram is associated with a loyalty program, and the first confirmationdata confirms a registration of the user as a member of the loyaltyprogram.
 12. The device of claim 1, wherein: the first element of thedistributed ledger records a registration object that includes the firstpublic key; and the second element of the distributed ledger records anupdated registration object that includes the second public key and thepointer data.
 13. A computer-implemented method, comprising: receiving,using at least one processor, first confirmation data from a firstcomputing system, the first confirmation data being indicative of arecordation of a first public key of an application program within afirst element of a distributed ledger, the application program beingexecuted by the at least one processor, and the first public key beingassociated with a first private key maintained within a portion of asecure data repository; based on a determined occurrence of aregeneration condition associated with the first public key,transmitting, using the at least one processor, a registration requestand a first digital signature applied to the registration request to asecond computing system, the registration request comprising a secondpublic key of the application program, and the second computing systembeing configured to validate the first digital signature, apply a seconddigital signature to the registration request and the first digitalsignature, and transmit the registration request, the first digitalsignature, and the second digital signature to the first computingsystem; receiving, using the at least one processor, second confirmationdata from the first computing system, the second confirmation data beingindicative of a recordation, within a second element of the distributedledger, of the second public key and pointer data identifying the firstelement; and based on the second confirmation data, and using the atleast one processor, storing a second private key associated with thesecond public key within the portion of the secure data repository, thestorage of the second private key invalidating the first private key.14. An apparatus, comprising: a communications interface; a memorystoring instructions; and at least one processor coupled to thecommunications interface and the memory, the at least one processorbeing configured to execute the instructions to: receive, from a devicevia the communications interface, a registration request and a firstdigital signature applied to the registration request, the registrationrequest being generated by an application program executed at the deviceand in response to a detected occurrence of a regeneration conditionassociated with a first public key of the application program, the firstpublic key being recorded within a first element of a distributedledger, and the registration request comprising a second public key ofthe application program; based on a validation of the first digitalsignature, approve the registration request and apply a second digitalsignature to the registration request and the first digital signature,the second digital signature being indicative of the approval of theregistration request by the apparatus; and transmit, via thecommunications interface, the registration request, the first digitalsignature, and the second digital signature to a computing system, thecomputing system being configured to validate the first digitalsignature and the second digital signature, and based on the validationof the first and second digital signature, to perform operations thatrecord, within a second element of the distributed ledger, the secondpublic key and pointer data identifying the first element.
 15. Theapparatus of claim 14, wherein, based on the confirmation data, theexecuted application program causes the device to invalidate a firstprivate key associated with the first public key.
 16. The apparatus ofclaim 14, wherein the at least one processor is further configured to:validate the first digital signature using the first public key of theapplication program; and apply the first second digital signature to theregistration request and to the first digital signature using a privatecryptographic key of the apparatus.
 17. The apparatus of claim 14,wherein the at least one processor is further configured to validate thefirst digital signature using the second public key of the applicationprogram.
 18. The apparatus of claim 14, wherein: the registrationrequest further comprises a first digital token generated by theapparatus and at least one of a network address of the device or anapplication cryptogram of the application program, the first digitaltoken being indicative of an authentication of a user associated withthe device; and the at least one processor is further configured to:obtain the first digital token from the registration request and load,from the memory, a second digital token associated with the at least oneof the network address or the application cryptogram; determine that thefirst digital token corresponds to the second digital token; and basedon the determination that the first digital token corresponds to thesecond digital token, and based on a validation of the first digitalsignature, approve the registration request and apply the second digitalsignature to the registration request and the first digital signature.19. The apparatus of claim 18, wherein the at least one processor isfurther configured to: receive authentication data from the device viathe communications interface, the authentication data comprising one ormore first authentication credentials of the user associated with thedevice; load, from the memory, second authentication credentialsassociated with the at least one of the network address orauthentication cryptogram; authenticate the user based on a determinedcorrespondence between the first and second authentication credentials;generate the first digital token based on the authentication of the userand transmit the first digital token to the device via thecommunications interface.
 20. The apparatus of claim 14, wherein the atleast one processor is further configured to: receive, from thecomputing system via the communications interface, confirmation dataindicative of the recordation of the second public key and the pointerdata within the second element of the distributed ledger; and transmitthe confirmation data to the device via the communications interface,the executed application program causing the device to present a portionof the confirmation data within a digital interface.